General

  • Target

    vbc.exe

  • Size

    647KB

  • Sample

    211208-rpks1afgd8

  • MD5

    69d6376700fcedd8295c6736ac7a121a

  • SHA1

    f2b84b76afd3e3c47be10841e7532cf8092564d5

  • SHA256

    cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4

  • SHA512

    b1d39422cd39db688d15701171932a49b93f6e1b3dd34e5113e961ec7c89fc2820c4a7a2c049ecdbf54dfe0aff0eecf2c20c74688c0b352bfbdd62eb6f63747b

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Targets

    • Target

      vbc.exe

    • Size

      647KB

    • MD5

      69d6376700fcedd8295c6736ac7a121a

    • SHA1

      f2b84b76afd3e3c47be10841e7532cf8092564d5

    • SHA256

      cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4

    • SHA512

      b1d39422cd39db688d15701171932a49b93f6e1b3dd34e5113e961ec7c89fc2820c4a7a2c049ecdbf54dfe0aff0eecf2c20c74688c0b352bfbdd62eb6f63747b

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Command-Line Interface

1
T1059

Defense Evasion

Scripting

1
T1064

Discovery

System Information Discovery

2
T1082

Tasks