Overview

overview

10

Static

static

1

MV ULTRASO...00.exe

windows7_x64

10

MV ULTRASO...00.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MV ULTRASONIC_PDA$62,000.exe

  • Size

    287KB

  • Sample

    220120-kc1kcshadq

  • MD5

    238fa7f1204998f7b13571649e15508a

  • SHA1

    e130539aee3a44c1902016476eb9f4304976aa4d

  • SHA256

    3f76d69c552a61ab3d1207fb64ac3aecf812e98f99c5413a9472d59859c38077

  • SHA512

    53c571454bd46209555718f97cb4b35c4dce038e52ec2a4d6a8c9315bacf569259ee3c511fc8e26c42a15739a91f8988339610c34d322a0c44c38dc92c6c3e41

Score
10/10
xloaderigwaloaderpersistenceratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

igwa

Decoy

listingswithalex.com

funtabse.com

aydenwalling.com

prochal.net

superfoodsnederland.com

moldluck.com

dianekgordon.store

regionalhomescommercial.com

mysecuritymadesimple.com

malwaremastery.com

kodaikeiko.com

jrzg996.com

agricurve.net

songlingjiu.com

virginianundahfishingclub.com

friendschance.com

pastelpresents.com

answertitles.com

survival-hunter.com

nxfddl.com

Targets

    • Target

      MV ULTRASONIC_PDA$62,000.exe

    • Size

      287KB

    • MD5

      238fa7f1204998f7b13571649e15508a

    • SHA1

      e130539aee3a44c1902016476eb9f4304976aa4d

    • SHA256

      3f76d69c552a61ab3d1207fb64ac3aecf812e98f99c5413a9472d59859c38077

    • SHA512

      53c571454bd46209555718f97cb4b35c4dce038e52ec2a4d6a8c9315bacf569259ee3c511fc8e26c42a15739a91f8988339610c34d322a0c44c38dc92c6c3e41

    Score
    10/10
    xloaderigwaloaderratsuricatapersistence

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks