General

  • Target

    MLSC-Shipping Documents.xlsx

  • Size

    181KB

  • Sample

    220616-g7wm4shfg8

  • MD5

    670993b8a4a75f7e7078b1c8e92ca5a1

  • SHA1

    813be857ea8da95c8613ed813aaf118f761e3096

  • SHA256

    0228f98d83b52281560b57fa73d47b773621409a2bb0cd0c9a1d2e0ac882684a

  • SHA512

    db20486318115c3d3ce20bc61cdd20f00b16500f69200c9df129e2d61951ccc233f8ac25b470cc90eefb9332c473cb980d410243987bc8ef677e2fdb0311401c

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

grh2

Decoy

xk0brx90clasle.xyz

xu0dmczr2rl4f5.xyz

ethiou.com

holtanalytical.site

bdswissminingtech.com

kardspodcast.com

phoenixtx.net

worldsriot.com

xn--cssvis15p.top

aydenalice.com

vinnyandfrens.com

greks33.com

clickintestinal.com

manningscr.com

ptryiuhfdsbc9522.xyz

cottageindentchi.xyz

ekknag-udps.tech

thedwordbydh.com

veganin.tech

leon-bet-uz.com

Targets

    • Target

      MLSC-Shipping Documents.xlsx

    • Size

      181KB

    • MD5

      670993b8a4a75f7e7078b1c8e92ca5a1

    • SHA1

      813be857ea8da95c8613ed813aaf118f761e3096

    • SHA256

      0228f98d83b52281560b57fa73d47b773621409a2bb0cd0c9a1d2e0ac882684a

    • SHA512

      db20486318115c3d3ce20bc61cdd20f00b16500f69200c9df129e2d61951ccc233f8ac25b470cc90eefb9332c473cb980d410243987bc8ef677e2fdb0311401c

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks