Overview

overview

10

Static

static

S28BW-4211...0.xlsx

windows7_x64

10

S28BW-4211...0.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S28BW-421122909390.xlsx

  • Size

    186KB

  • Sample

    220223-l6tjkshff2

  • MD5

    50d0fd4846a8e72a6b4f59f0f3df86d1

  • SHA1

    b7dba6c5817183a7db693e1fe7d799a9d86b9126

  • SHA256

    456ca33de7c167dfc6964c7862a89cfac7ef8e6228756f0c1c3b85fcaea0dd6f

  • SHA512

    71c9a90ecc211bd6137e025f455e70adf94290da30887a7f395e3603280652ad558276019d1c3799a74c41a30020bcc501108aa59a3f356e072ab601048d9358

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      S28BW-421122909390.xlsx

    • Size

      186KB

    • MD5

      50d0fd4846a8e72a6b4f59f0f3df86d1

    • SHA1

      b7dba6c5817183a7db693e1fe7d799a9d86b9126

    • SHA256

      456ca33de7c167dfc6964c7862a89cfac7ef8e6228756f0c1c3b85fcaea0dd6f

    • SHA512

      71c9a90ecc211bd6137e025f455e70adf94290da30887a7f395e3603280652ad558276019d1c3799a74c41a30020bcc501108aa59a3f356e072ab601048d9358

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks