Overview

overview

10

Static

static

Overdue St...nt.exe

windows7_x64

10

Overdue St...nt.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Overdue Statement of Account.exe

  • Size

    418KB

  • Sample

    211020-ynnltsadgm

  • MD5

    862838f5e798c19a2c222994789b5b73

  • SHA1

    7dce91828df96ad8a6dae4fa1415dbf6755cb143

  • SHA256

    a2067ce6f40be6dee1fa10c0155582a43e4b4d5b4bfe1fcf7f239332534b7109

  • SHA512

    06b9d77e854045c88bc9440f0e3680930687319c4e0ba9cdf1271614d66b6d732dfd354c27ea847374c7cffde2a786810240888a19431e1ebe9707c2cc3671c2

Score
10/10
xloadernaecloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

naec

C2

http://www.logternal.com/naec/

Decoy

thugcephus.com

yelomasala.com

rowyprima.quest

besasin09.com

globerentalcar.com

super-dev-li.online

legendaparayoutube.com

sharj4030.online

freebiesandgiveaways.com

greenidge.bet

aligned.guide

limowatchshop.com

cqreb.com

justforlulu.xyz

sppn.info

mycaroutlet.store

lcrventures.com

ultimateapparelprints.online

katakorik.com

jfrecycling.com

Targets

    • Target

      Overdue Statement of Account.exe

    • Size

      418KB

    • MD5

      862838f5e798c19a2c222994789b5b73

    • SHA1

      7dce91828df96ad8a6dae4fa1415dbf6755cb143

    • SHA256

      a2067ce6f40be6dee1fa10c0155582a43e4b4d5b4bfe1fcf7f239332534b7109

    • SHA512

      06b9d77e854045c88bc9440f0e3680930687319c4e0ba9cdf1271614d66b6d732dfd354c27ea847374c7cffde2a786810240888a19431e1ebe9707c2cc3671c2

    Score
    10/10
    xloadernaecloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks