Overview

overview

10

Static

static

8

Purchase o...DF.exe

windows7_x64

10

Purchase o...DF.exe

windows10_x64

10

Purchase o...7.xlsm

windows7_x64

10

Purchase o...7.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase order 45037966707.7z

  • Size

    388KB

  • Sample

    211028-x1drqacbc2

  • MD5

    9ab9b9118cf399d96f42c5a92bef2822

  • SHA1

    d302e1567e7916056da784ec9894da2e81a950f6

  • SHA256

    1bb358787d60e233085600f2c9140c228314fa4ba9d9a49f85c2605359d47cc2

  • SHA512

    7550d43a60b126f9736314966418a9211d9351b9664da7e9e47cc23fb98c06ba57a4a6659d030058729f11077fb44ec546c286145733c38f3c95b0137d8ba5a4

Score
10/10
xloaderpufiloadermacrorat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://20.102.53.71/mvn/systemdc.exe

Targets

    • Target

      Purchase order 45037966707/Purchase order 45037966707.xlsm

    • Size

      22KB

    • MD5

      9fc5194e1a01302c4495dfeb12f47085

    • SHA1

      d61c8d632c0b6a1395d4c8e7702bb93f11e5c318

    • SHA256

      37ea86d0e937ae285a463cf50c529ca69d6621f49c34e03b407fc2726b292d0c

    • SHA512

      1e06c982cc4907a0d343324fd022d549545c74879bc57b2b2350c84ce42da3917a5dde889ff3b1511b52cf58eb1c9aad5d41bf49b8dad2aa407510ecc0b8c505

    Score
    10/10
    xloaderpufiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      Purchase order 45037966707/Purchase order 45037966707_PDF.exe

    • Size

      570KB

    • MD5

      91679f42cd3ba051b5c7ce37d45b222c

    • SHA1

      decc607894a299033ed3ede115a3bce51d21020b

    • SHA256

      e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e

    • SHA512

      b3dd48fc2267a50e9468e0e0be746e224618fd4aaab07e69c3f32c473831145a9fdd6a4cf87266f284bed9c9d1bf227f21f244d15242582f096dc4bf9c64855a

    Score
    10/10
    xloaderpufiloaderrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks