Overview

overview

10

Static

static

1

PURCHASE ORDER.exe

windows7_x64

10

PURCHASE ORDER.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PURCHASE ORDER.zip

  • Size

    349KB

  • Sample

    220221-kdk63agce7

  • MD5

    13a73ae898228b2ddbb4a3536f491420

  • SHA1

    c98fc2d4270f34ff58b1028279ee55f8ea4da0e2

  • SHA256

    175eaa6e426013c9ceddc8abfd882d5370bb2684f5b7d8f9f353b466533a3fe4

  • SHA512

    62e62a6d284dfddf66325b684c847363b9ef437a9dc914a444f4750d924548f61fbe1bd9153c22e1804af2e8f7ce66443eea0c7a2a1b40b071d294b8e46b374f

Score
10/10
xloaderyrcyloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yrcy

Decoy

sturlabas.com

tantrungcompany.com

wildgraceyogahealing.com

wsparalegal.com

8xhgq.xyz

mysaylav.com

amelntl.net

cooleshow.online

adventuresbydisneyathome.com

sprinklekart.com

prostitutkitambovasuck.info

pakdao.com

finsith.com

nightpartner82.xyz

sex9a4ufbj.com

ketohousee.com

mairie-les-cammazes.com

elebots.xyz

highqualityremodeling.net

teamsterslocal553.com

Targets

    • Target

      PURCHASE ORDER.exe

    • Size

      526KB

    • MD5

      98eb274e5755b5c4ed216fd19e7243ba

    • SHA1

      a90c0bd93792bdd29b1ea2b5bf967672e16e28da

    • SHA256

      97b6532c228002e364a4bb3ad8efb13b1b13f9bbacfc93416b7b56f371e25983

    • SHA512

      feeee4d289d5c9b94bec004beaa5908237ea1ef9ee7a4bbb6b189b1b685023fe9be332cfbebda4b10a73164912e2a63f78bd9ad64b5b36ad43a519d7a07ed07c

    Score
    10/10
    xloaderyrcyloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks