Overview

overview

10

Static

static

1

DHL Express.exe

windows7_x64

10

DHL Express.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Express.exe

  • Size

    248KB

  • Sample

    220127-qeyfnsdbhj

  • MD5

    bba45c96ad4627c4c0b1f25fb7a23c7a

  • SHA1

    6f9c219a08aca7c57f6add9d8a730be6178713c6

  • SHA256

    d80690916721f1f23e0c913d3f6c71428464e8141a49763c75e450ef21d984e8

  • SHA512

    4b823ce229d01060b72ea7ace20d81c9be83462af38c29fad0de9ae493c4db18ae2dbaa53cbb32086082b83246d6467a4a7c81bebf016bdd00c303aaa44a0e31

Score
10/10
xloader3a4hloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

3a4h

Decoy

mohamedmansour.net

asap.green

influxair.com

45mpt.xyz

cablerailingdesign.com

salesdisrupter.com

cxfarms.com

enerconfederal.com

pl1x.top

nyoz.top

fitnesz.website

minimi36.com

borealiselectricalrepair.com

miskalqurashi.com

importacionesdelfuturo.com

cigfinanacial.com

luxamata.xyz

digicoin724.com

gozabank.com

tribal-treasures.com

Targets

    • Target

      DHL Express.exe

    • Size

      248KB

    • MD5

      bba45c96ad4627c4c0b1f25fb7a23c7a

    • SHA1

      6f9c219a08aca7c57f6add9d8a730be6178713c6

    • SHA256

      d80690916721f1f23e0c913d3f6c71428464e8141a49763c75e450ef21d984e8

    • SHA512

      4b823ce229d01060b72ea7ace20d81c9be83462af38c29fad0de9ae493c4db18ae2dbaa53cbb32086082b83246d6467a4a7c81bebf016bdd00c303aaa44a0e31

    Score
    10/10
    xloader3a4hloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks