Overview

overview

10

Static

static

Berthing.xlsx

windows7_x64

10

Berthing.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Berthing.xlsx

  • Size

    131KB

  • Sample

    220511-kybhcsgbh9

  • MD5

    95b1b15c87f5d6daba1c72e6514a9fc1

  • SHA1

    4f05f44baf5d8d3e31dc050c79f1d8703c82e0be

  • SHA256

    719ac8462a554ec46d13e7c3b33c39248d546da6e9618edec381656472814352

  • SHA512

    bf1f39e08e3baeabc034145b9ec04b56787ee80d9c408d89368b88f6e0a5508e94d3921e1887efd47988f8e0d275530c854095d4d19861221a9cc939776afad4

Score
10/10
xloaderbs8floaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

bs8f

Decoy

atmospheraglobal.com

dontshootima.com

bestofferusde.club

yourdigitalboss.com

breskizci.com

myarrovacoastwebsite.com

reasclerk.com

efrovida.com

wsmz.net

upneett.com

loefflerforgov.com

noida.info

trndystore.com

arhaldar.online

vivibanca.tech

mykrema.com

vseserialy.online

ridgewayinsua.com

heauxland.com

bestcollegecourses.com

Targets

    • Target

      Berthing.xlsx

    • Size

      131KB

    • MD5

      95b1b15c87f5d6daba1c72e6514a9fc1

    • SHA1

      4f05f44baf5d8d3e31dc050c79f1d8703c82e0be

    • SHA256

      719ac8462a554ec46d13e7c3b33c39248d546da6e9618edec381656472814352

    • SHA512

      bf1f39e08e3baeabc034145b9ec04b56787ee80d9c408d89368b88f6e0a5508e94d3921e1887efd47988f8e0d275530c854095d4d19861221a9cc939776afad4

    Score
    10/10
    xloaderbs8floaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks