Overview

overview

10

Static

static

BL.xlsx

windows7_x64

10

BL.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BL.xlsx

  • Size

    289KB

  • Sample

    220428-g8wphabbf3

  • MD5

    b8e9f95d4fa7c45a88a676e7bb3fc9ae

  • SHA1

    acc6e22cbca2be6226fbddd46ce1ae8304f4f996

  • SHA256

    a5710d566d75764e63a8669e72f21b5542c234af87a4217cf0415799cbe9c5e1

  • SHA512

    27ce1fc0a872ec06fd8cc5ca9d8da3dda05988a887e29b14066648fb855b8977169dca0e0c585c7516359ce10321787de57a682da39eed347f1cdbd922da254e

Score
10/10
xloaderbs8floaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

bs8f

Decoy

atmospheraglobal.com

dontshootima.com

bestofferusde.club

yourdigitalboss.com

breskizci.com

myarrovacoastwebsite.com

reasclerk.com

efrovida.com

wsmz.net

upneett.com

loefflerforgov.com

noida.info

trndystore.com

arhaldar.online

vivibanca.tech

mykrema.com

vseserialy.online

ridgewayinsua.com

heauxland.com

bestcollegecourses.com

Targets

    • Target

      BL.xlsx

    • Size

      289KB

    • MD5

      b8e9f95d4fa7c45a88a676e7bb3fc9ae

    • SHA1

      acc6e22cbca2be6226fbddd46ce1ae8304f4f996

    • SHA256

      a5710d566d75764e63a8669e72f21b5542c234af87a4217cf0415799cbe9c5e1

    • SHA512

      27ce1fc0a872ec06fd8cc5ca9d8da3dda05988a887e29b14066648fb855b8977169dca0e0c585c7516359ce10321787de57a682da39eed347f1cdbd922da254e

    Score
    10/10
    xloaderbs8floaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks