xloader

Sharing

Copy URL Twitter E-mail

General

Target
bank details.exe
Size 856KB
Sample210329-89flss7mvn
SHA256 30a292327e2f65edf2c2cfbd07b60435b1845dbd504b15ad47116ad9d5fb1084
MD5 ce5dbb9fe4118147b8357f15cee98188
SHA1 9485ced749354a0d2dfb8ff5d232657435d8cfba
SHA512 d47cbd36a11bb50a2abfa3606bcea59c97e48620c2059f0516f513dc14c4a66b870816be1f04f6a0e6a75fd835cdcc4c0ce83537db0183bf07b5f20d5bc1c7a0
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

xloader

http://www.bestleadsfunnel.com/n30n/

Decoy

philliprobertdowell.com
shopofficialbrand.com
bwi.email
prolosers.com
nuspapar.com
webworkersmonterrey.com
stluciaestuary.com
3yks.club
upendrafansclub.com
cooltechbd.com
slfuntap.com
tatsuhomeblog.com
halsa.life
milwaukeehemorrhoidclinic.com
mes-produits-frais.com
jpswonggroup.com
moodwinner.com
g-customerbenefits.com
petzoapp.com
portofolio-aang.info
zenithbuids.com
oboshorekaj.com
sayanmukherjeedigital.com
oespecialista50.com
shinebi.com
pod14.club
milestonesrls.online
myhookupsite.com
makerealmoneyandprofit.com
ecomponentsource.com
ontimetransportationinc.com
ltmotorsport.com
turntupfitness.com
helenmorelli.com
scomdoctors.com
contex33.xyz
thecannaglomerate.com
nordiktherapie.com
iglesiasanidad.com
localadventurer.website
gixdsegg.com
farsidec.com
sweepallday.com
foundyourspouse.info
elite-fondation.net
eatingwithoutlaw.com
laflormagica.com
alternategardening.com
wildnstyle.com
truyennguoilonhihi.info
vrgamestickets.com
xoom.group
gallerihuset.com
heredity-deal.com
beyondthegarageroadside.com
lasolarfactory.com
cherylkayedesigns.com
limvory.com
chinlon.com
learningnoodles.com
add15yearsnextstep.com
militaryvirtualairline.com
trapphresh.com
websturantstores.com

Targets

- Target
  bank details.exe
- Size 856KB
- SHA256 30a292327e2f65edf2c2cfbd07b60435b1845dbd504b15ad47116ad9d5fb1084
- MD5 ce5dbb9fe4118147b8357f15cee98188
- SHA1 9485ced749354a0d2dfb8ff5d232657435d8cfba
- SHA512 d47cbd36a11bb50a2abfa3606bcea59c97e48620c2059f0516f513dc14c4a66b870816be1f04f6a0e6a75fd835cdcc4c0ce83537db0183bf07b5f20d5bc1c7a0
- MD5 SHA1 SHA512
Score

10^/10

xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2