Fake purchase-order emails deliver XLoader via Equation Editor flaw
Original title: Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents
ASEC says a DOCX uses altChunk and CVE-2017-11882 to run scripts, persist at logon, and execute XLoader 8.9 in memory.
ASEC reported on November 12 that phishing emails posing as purchase orders attach a Word document that leads to XLoader. The DOCX embeds an RTF through altChunk, and an Equation Editor object exploits CVE-2017-11882 to run a dropped Visual Basic script. PowerShell stages store content in the registry, set a current-user Run entry, XOR-decrypt the payload, and execute XLoader 8.9 in memory. ASEC says it steals computer and browser data and can download more malware. No actor, recipient count, or infection total is given.
Unconfirmed: ASEC does not name an actor or confirm how many organizations or systems were compromised.
- The sample lure cites an order of $144,744.50 and the attachment PORD051071.docx.
- The chain drops %TMP%\724812.vbs and encoded data as %TMP%\Quisque.Dal.
- Persistence uses HKCU Run value Cupidatat plus Environment and AppDataLow registry values.
- ASEC lists C2 http://www.dumbsplash.com/ilto/ and XOR key 0X6B506102.
- XLoader version information in the sample shows release 8.9.
Impact: Steals computer and browser data and can fetch more malware
| Product | Affected |
|---|---|
| Microsoft Equation Editor | — |
- 1.Verify unexpected purchase orders with a known contact before opening attachments.
- 2.Keep Office patched, including the Equation Editor fix for CVE-2017-11882.
- 3.Hunt for the published hashes, dumbsplash.com, and the named registry Run value.
- CVEs
- CVE-2017-11882
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1059.001 PowerShellT1547.001 Registry Run Keys / Startup Folder
- Vendors
- Microsoft
- Products
- Microsoft WordEquation Editor
- Malware
- XLoader
- Organizations
- ASEC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.dumbsplash.com | 734f9bf2eecf8ba5b9a5fb8a25f Equation object C2 URL http[:]//www[.]dumbsplash[.]com/ilto/ Command server Attachment PORD051071.docx Purchas |
| md5 | 56cc0734f9bf2eecf8ba5b9a5fb8a25f | S MD5 e0d7a34bc9f4590bc073d08b50c854d1 Published sample MD5 56cc0734f9bf2eecf8ba5b9a5fb8a25f Equation object C2 URL http[:]//www[.]dumbsplash[.]com/ilto |
| md5 | 5bd3c5f273ba5ae4c4ae745c6943a4f7 | ndicators of compromise (IoCs):- Type Indicator Context MD5 5bd3c5f273ba5ae4c4ae745c6943a4f7 Published sample MD5 8b3542531d98a47524c0f468d0158996 Embed |
| md5 | 8b3542531d98a47524c0f468d0158996 | t MD5 5bd3c5f273ba5ae4c4ae745c6943a4f7 Published sample MD5 8b3542531d98a47524c0f468d0158996 Embedded VBS MD5 e0d7a34bc9f4590bc073d08b50c854d1 Published |
| md5 | e0d7a34bc9f4590bc073d08b50c854d1 | ample MD5 8b3542531d98a47524c0f468d0158996 Embedded VBS MD5 e0d7a34bc9f4590bc073d08b50c854d1 Published sample MD5 56cc0734f9bf2eecf8ba5b9a5fb8a25f Equat |
From the original article
4 min read at cybersecuritynews.com
Hackers are sending fake purchase order emails to trick recipients into opening Word documents that deliver XLoader, an information-stealing malware. The attack uses an embedded document, an old Microsoft Equation Editor vulnerability, and several script stages to reach its final payload. What begins as a routine order confirmation can end with stolen browser data and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.