Xloader Phishing Emails Disguise Purchase Order Confirmation Requests

Fast Facts

1. Purchase-order phishing delivers a DOCX that uses Word altChunk to execute an embedded RTF and exploit CVE-2017-11882.
2. VBS and PowerShell stages establish logon persistence via the Cupidatat Run key and decrypt/load the payload in memory.
3. The XLoader 8.9 infostealer steals PC and browser data and can download more malware; C2: dumbsplash[.]com/ilto/.

Threat, Techniques, and Targets

• ASEC identified phishing emails that pose as purchase order confirmation requests. The emails urge recipients to open an attached DOCX file to verify an order. Therefore, employees who handle order related messages may encounter this lure.
• When a recipient opens the file, Word processes a malicious RTF document embedded through the altChunk feature. An OLE object then exploits CVE 2017 11882 to run a VBS file. Next, PowerShell scripts decrypt and launch the XLoader payload.
• The malware adds a registry entry to run its script when the user logs in. It also decrypts the payload with an XOR operation and runs it in memory.

Impact, Security Implications, and Remediation

• XLoader steals sensitive information, including computer details and browser data. It can also download additional malware. As a result, an infected system may face further data theft or malware activity.
• Verify that the sender uses an official email domain. Also, inspect links and attachments before opening them. Before entering sensitive information, confirm that the page uses the organization’s official URL and check its security certificate.
• The report does not provide specific cleanup steps for infected systems. Therefore, contact ASEC, your security team, or another relevant authority for incident response guidance.

Stay Ahead with the Latest Tech Trends

Stay informed on the revolutionary breakthroughs in Quantum Computing research.

Access comprehensive resources on technology by visiting Wikipedia.

ThreatIntel-V1