Overview

overview

10

Static

static

1

DHL_119040...df.exe

windows7_x64

10

DHL_119040...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL_119040 receipt document,pdf.exe

  • Size

    376KB

  • Sample

    211022-dmyp7abaf8

  • MD5

    a26c06af19d765ddcb32a48cd6acb1eb

  • SHA1

    152dcab66baef093434bf69a0c3f9e78f7bbeb90

  • SHA256

    35204f1850b1439ef9a8fd958d6c3045edae69378aa3593021795d0600fc5a01

  • SHA512

    98945dbca44f5620c66efb7fc323e796e04040d0d19a1e5514843daa5c3ee6696739e9e19c6b38ff78ce3328db45d073cab471fabd591e4b962248b4d24422fb

Score
10/10
xloaderb65iloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b65i

C2

http://www.onewebuy.net/b65i/

Decoy

leofighters.com

smartat2.xyz

encontrevariedades.com

jimwilliamstutoring.com

kanpaiecuador.com

accura-inv.com

xtzgjxzz.com

scentstrategies.com

high-clicks2.com

hadishgebray.com

woodlawnbailbonds.com

dmsolutionsco.com

rdvulm21.com

beachyweens.com

ishirmansingh.com

rimmasbracelets.com

kellibrat.com

roselmasm.com

datkamoney.info

fermers.club

Targets

    • Target

      DHL_119040 receipt document,pdf.exe

    • Size

      376KB

    • MD5

      a26c06af19d765ddcb32a48cd6acb1eb

    • SHA1

      152dcab66baef093434bf69a0c3f9e78f7bbeb90

    • SHA256

      35204f1850b1439ef9a8fd958d6c3045edae69378aa3593021795d0600fc5a01

    • SHA512

      98945dbca44f5620c66efb7fc323e796e04040d0d19a1e5514843daa5c3ee6696739e9e19c6b38ff78ce3328db45d073cab471fabd591e4b962248b4d24422fb

    Score
    10/10
    xloaderb65iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks