Overview

overview

10

Static

static

0077 (21-2...D.xlsx

windows7_x64

10

0077 (21-2...D.xlsx

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0077 (21-22) PERFORMA INVOICE AND SALE CONTRACT REVISED.xlsx

  • Size

    187KB

  • Sample

    220209-r8sb7aafd2

  • MD5

    6bb6abca3b7735d56f66f5078151a213

  • SHA1

    f513bb85a9d5d38f8026343fdb8a69ecd7376bc9

  • SHA256

    119185f4a52970a65f9c4c893341594eb33f117bc42afe9297da34365960b22d

  • SHA512

    d732f8ea16ae73c2937db98cb4a4a422c1fdbdbed164ed2319f4a034d55b5ae830e23d8ff4a188b5e46597fab38aa38b619796234d708bea4940d64a786bce10

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      0077 (21-22) PERFORMA INVOICE AND SALE CONTRACT REVISED.xlsx

    • Size

      187KB

    • MD5

      6bb6abca3b7735d56f66f5078151a213

    • SHA1

      f513bb85a9d5d38f8026343fdb8a69ecd7376bc9

    • SHA256

      119185f4a52970a65f9c4c893341594eb33f117bc42afe9297da34365960b22d

    • SHA512

      d732f8ea16ae73c2937db98cb4a4a422c1fdbdbed164ed2319f4a034d55b5ae830e23d8ff4a188b5e46597fab38aa38b619796234d708bea4940d64a786bce10

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks