Overview

overview

10

Static

static

ORIGINAL D...).xlsx

windows7_x64

10

ORIGINAL D...).xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORIGINAL DOCS (INVOICES-BL-PACKING LIST).xlsx

  • Size

    167KB

  • Sample

    220707-ggvywseael

  • MD5

    427844798df6d54274eb9dbb7ccf2859

  • SHA1

    ee430c29a1584d4ec0326b9ef244865bc9148b70

  • SHA256

    52061b89eea6713279a56c1d0075b94c2dbda96772592271b9200c81a0941426

  • SHA512

    69b8f81ee43e90db550463f54e01144240d768874c9f94dd782361ff8bd23517f8e9b600849d467dfc9a9d4fe11d601c8c29d8a91e87a50add681fc68f51e5dd

Score
10/10
xloadera2esloaderrat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a2es

Decoy

glutenfreebahrain.com

sportrid.com

js-films.com

cie-revolver.com

outsourcinginstitutebd.com

roboticsdatascience.com

tebrunk.com

needgreatwork.com

df1b8j2iwbl33n.life

voluum-training.com

cherna-roza.com

xiyouap.com

bluefiftyfoundation.com

angolettomc.com

yhcp225.com

keondredejawn.com

ifeelsilky.com

coraorganizing.com

smartmindstutorials.com

tanphucuong.info

Targets

    • Target

      ORIGINAL DOCS (INVOICES-BL-PACKING LIST).xlsx

    • Size

      167KB

    • MD5

      427844798df6d54274eb9dbb7ccf2859

    • SHA1

      ee430c29a1584d4ec0326b9ef244865bc9148b70

    • SHA256

      52061b89eea6713279a56c1d0075b94c2dbda96772592271b9200c81a0941426

    • SHA512

      69b8f81ee43e90db550463f54e01144240d768874c9f94dd782361ff8bd23517f8e9b600849d467dfc9a9d4fe11d601c8c29d8a91e87a50add681fc68f51e5dd

    Score
    10/10
    xloadera2esloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks