Overview

overview

10

Static

static

RequestLet...EC.exe

windows7_x64

10

RequestLet...EC.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Courtesy Request Letter on 12DEC.cab

  • Size

    894KB

  • Sample

    211213-kywhjaeedp

  • MD5

    d59b10675f34c9725bad740d861d83c5

  • SHA1

    16aede0762fb5feeba39ee04316d410297c8d3ae

  • SHA256

    d12c264102a42c65f256f4b4387031c6444c6958934acbb13b335567bc3735a0

  • SHA512

    39d3064d9a8c3236a58d36acacadc118406872385f730ffbed0d96e5b89a1013c3122c3f77e7d29cfc091c61cba40a05c0ed7f90f6054d62f5cce16b76fbbff7

Score
10/10
xloaderef6cloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      RequestLetter 11DEC.exe

    • Size

      907KB

    • MD5

      eb62d3d13ff0e6dc6e3daa1b2513676c

    • SHA1

      98a8345372e8b6ff98826c35f55fe594384eb235

    • SHA256

      993e2502c86bc87766ee853a75c89ffe6a635383c685b1aea785364b7c101b59

    • SHA512

      0592c3a025423d1b718a9d05a0619a2939877f420123580e02343d830ede8789df6a661b7745d3a3f046a7c9f33431179188390ed9b8f577138703bd9af92042

    Score
    10/10
    xloaderef6cloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks