Overview

overview

10

Static

static

RIOSAT_DOC.xlsx

windows7_x64

10

RIOSAT_DOC.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RIOSAT_DOC.xlsx

  • Size

    201KB

  • Sample

    211103-xx84fseeh2

  • MD5

    4ed0940e6e53d246dae50a1a7dda5f68

  • SHA1

    4439f0cdb3937226cb4015ec4c2df54a36c29f65

  • SHA256

    e6b973beff845a214101c3f4714d32f15112b86a9fbfbd301914063f2e4e5677

  • SHA512

    7f7734d8f9983339f279e95b76ce78743875889e5a1e7951f80e9e984ac34b31312ee0f80682976895e030d0784ec17be5b0ec65536a86b448706979a0f288f9

Score
10/10
neshtaxloaderht08loaderpersistenceratspywarestealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ht08

C2

http://www.septemberstockevent200.com/ht08/

Decoy

joye.club

istanbulemlakgalerisi.online

annikadaniel.love

oooci.com

curebase-test.com

swisstradecenter.com

hacticum.com

centercodebase.com

recbi56ni.com

mmj0115.xyz

sharpstead.com

sprklbeauty.com

progettogenesi.cloud

dolinum.com

amaroqadvisors.com

traininig.com

leewaysvcs.com

nashhomesearch.com

joy1263.com

serkanyamac.com

Targets

    • Target

      RIOSAT_DOC.xlsx

    • Size

      201KB

    • MD5

      4ed0940e6e53d246dae50a1a7dda5f68

    • SHA1

      4439f0cdb3937226cb4015ec4c2df54a36c29f65

    • SHA256

      e6b973beff845a214101c3f4714d32f15112b86a9fbfbd301914063f2e4e5677

    • SHA512

      7f7734d8f9983339f279e95b76ce78743875889e5a1e7951f80e9e984ac34b31312ee0f80682976895e030d0784ec17be5b0ec65536a86b448706979a0f288f9

    Score
    10/10
    neshtaxloaderht08loaderpersistenceratspywarestealer

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks