Overview

overview

10

Static

static

SHIPPING-DOC.xlsx

windows7_x64

10

SHIPPING-DOC.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHIPPING-DOC.xlsx

  • Size

    228KB

  • Sample

    211119-j9kpqscgc3

  • MD5

    dfd2b8cbb44d1484243e6af091feb34d

  • SHA1

    734f74e75da86a282e03eb874daf93bbb12864a1

  • SHA256

    d20d22cdd9af5bde44d0f1c11f915f13dbc97ed3ab3114eacbe7edc48b11e540

  • SHA512

    e167710a475f41d94dee41fba09361aa8d867d442726c93ed8d8624bfd2561770b63ff592239e357fc20905ca314fb95abba401ce0209a6e6daf670e0797de8b

Score
10/10
xloaderi3gsloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

i3gs

C2

http://www.casacampestreelrocio.com/i3gs/

Decoy

mobizoneoficial.com

gkdesignerjal.com

takut8.com

yh88ff.com

zauqeshayari.com

wil-wei.store

baipees.com

pawaddictsva.com

sexnft.xyz

guizuzbj.com

impfpflicht.net

australiaaddictioncenters.com

beatsingh.com

fominospratico.com

papeisonline.com

asesoriaventajoyas.com

climasfesan.com

foodfar.space

dailyhealthelp.com

blackmagiccomics.com

Targets

    • Target

      SHIPPING-DOC.xlsx

    • Size

      228KB

    • MD5

      dfd2b8cbb44d1484243e6af091feb34d

    • SHA1

      734f74e75da86a282e03eb874daf93bbb12864a1

    • SHA256

      d20d22cdd9af5bde44d0f1c11f915f13dbc97ed3ab3114eacbe7edc48b11e540

    • SHA512

      e167710a475f41d94dee41fba09361aa8d867d442726c93ed8d8624bfd2561770b63ff592239e357fc20905ca314fb95abba401ce0209a6e6daf670e0797de8b

    Score
    10/10
    xloaderi3gsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks