General

  • Target

    list.xlsx

  • Size

    182KB

  • Sample

    220121-mxb4lsbee6

  • MD5

    73bafd13dd3a637036a13fca6fb1b232

  • SHA1

    e8a56b2195a47a5d57a9800847257e30a0d94ff6

  • SHA256

    0f5826444c6b1941a7bbf999ae4aa7488b96d57732be19d4f0ac87415cf26beb

  • SHA512

    b62173346507b78d7649ce8255d298150183c0d828eb777214f7df1df259fc1e9b0af5aaa66dbeed1636bc736764d3cc1041af7c29bc236b1141c86f058a5a92

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

jdo2

Decoy

adopte-un-per.com

lmandarin.com

shonemurawni.quest

bantasis.com

jsdigitalekuns.net

hiddenroom.net

arungjerampangalengan.com

yinghongxw.com

buzzcupid.com

lattent.digital

faxtoemailguide.com

romanticfriryrose.com

ruleaou.com

mochiko-blog.com

sekireixploit.com

bcx-wiremesh.com

jobportalsg.com

wysspirit.com

iflycny.com

sh-cy17.com

Targets

    • Target

      list.xlsx

    • Size

      182KB

    • MD5

      73bafd13dd3a637036a13fca6fb1b232

    • SHA1

      e8a56b2195a47a5d57a9800847257e30a0d94ff6

    • SHA256

      0f5826444c6b1941a7bbf999ae4aa7488b96d57732be19d4f0ac87415cf26beb

    • SHA512

      b62173346507b78d7649ce8255d298150183c0d828eb777214f7df1df259fc1e9b0af5aaa66dbeed1636bc736764d3cc1041af7c29bc236b1141c86f058a5a92

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks