Overview

overview

10

Static

static

vbc.exe

windows7_x64

10

vbc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vbc.exedcsuweoc

  • Size

    553KB

  • Sample

    220626-gw3maahfgj

  • MD5

    4add727d1541102e34e167c689892d98

  • SHA1

    368ef2217b4146efb0f2154900628c6e374828e8

  • SHA256

    6934dc8f453b1832dc1a7579a1b3888a1e7e4a7ab19f30fe975bbed018388ace

  • SHA512

    2fdc3db9cd0dad7fa365603060dc5da1b9a5708aa619c7c5b174c3a659d1e1c3bb0a18b124983a5204b84b80d0a80afc67058a6c241cfe45b85b504d0ab55e42

Score
10/10
xloaderr87gloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r87g

Decoy

gzjyjzsj.com

rapibest.com

affordablebathroomsbyfrank.net

roboruben.com

xn--dlisucr-byag.com

encoreasso.com

piscire.com

dixiebusybee.com

newrome.xyz

sunshinejon.com

glacierforfcs.xyz

borhanmarket.com

tous-des-cons.club

hsfstea.com

spiniform.info

vaicomfibra.com

shinigami.xyz

kryptoindia.com

listentoappetite.com

securepplpay.com

Targets

    • Target

      vbc.exedcsuweoc

    • Size

      553KB

    • MD5

      4add727d1541102e34e167c689892d98

    • SHA1

      368ef2217b4146efb0f2154900628c6e374828e8

    • SHA256

      6934dc8f453b1832dc1a7579a1b3888a1e7e4a7ab19f30fe975bbed018388ace

    • SHA512

      2fdc3db9cd0dad7fa365603060dc5da1b9a5708aa619c7c5b174c3a659d1e1c3bb0a18b124983a5204b84b80d0a80afc67058a6c241cfe45b85b504d0ab55e42

    Score
    10/10
    xloaderr87gloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks