Overview

overview

10

Static

static

BORG EL AR...8.xlsx

windows7_x64

10

BORG EL AR...8.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BORG EL ARAB _ OC 104117978.xlsx

  • Size

    186KB

  • Sample

    220302-vnlkpaffh4

  • MD5

    fc8b48015d13241e10a8a39f79acb497

  • SHA1

    9d03fee0b9d5848b3518505e3be0fac9b09af059

  • SHA256

    30e0ddcca8b2f009fcd0d465afe04bcb6a274532ecca935c0a544efe305f10ac

  • SHA512

    4e2c805a83b3a111482f5a0e2e518541dc6d12dd78b6cd0e7756101d0f069190debbe95704ef49ee2b421f181b2f1b7e5b3ab3c41e19e20225ec2a5473a3603f

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      BORG EL ARAB _ OC 104117978.xlsx

    • Size

      186KB

    • MD5

      fc8b48015d13241e10a8a39f79acb497

    • SHA1

      9d03fee0b9d5848b3518505e3be0fac9b09af059

    • SHA256

      30e0ddcca8b2f009fcd0d465afe04bcb6a274532ecca935c0a544efe305f10ac

    • SHA512

      4e2c805a83b3a111482f5a0e2e518541dc6d12dd78b6cd0e7756101d0f069190debbe95704ef49ee2b421f181b2f1b7e5b3ab3c41e19e20225ec2a5473a3603f

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks