xloader

Sharing

Copy URL Twitter E-mail

General

Target
FORMULARIO DE PROVEEDOR.exe
Size 425KB
Sample210331-7qwa8k647x
SHA256 cb15e1a8f3339acd45d00adabdffef0ed9f169f0df0080c7f373396c16652236
MD5 30e2973d62b11bd535b4eb7d18b044f8
SHA1 91ef667022de5e726d9858752690cc390bc06366
SHA512 20cf26abac7a550abfcfc1a7613bc4c1f9b25283a8359fc5ba382ad0907d2d55e068a96dbe5a2a12c69ffd357a8120275880fb6011a6d374f70110f739f668a7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

xloader

http://www.trendyheld.com/edbs/

Decoy

ehealthak.com
kingdavidtiferetshop.com
allincursive.com
quickshop.xyz
hallfaxgroupuk.online
barebeautybrand.com
verificationpays.com
2k20-aide.com
cameralogs.com
blackdotdesignco.com
thepredictable360.com
huangguanlin600270.com
hounslowkebab.com
kuppers.info
ohjoephoto.com
bhavyaarora.com
thecoolprojector.com
abelprocess.com
856379765.xyz
growth.run
skin-win.net
dovepethospital.com
mchglobe.com
roleta.site
kolmonitor.com
clientcentre.net
vietngapcapp.info
cakeunderwear.com
hilleye24.com
gekijyou.com
bohemianquill.com
subjectfield.store
highclassmassage.club
buttergolfco.com
mangaarabic.com
sagemenerji.com
mastermind-kc.com
affiliate-revenue.site
ienvoices.com
lojewski4assembly.com
mitchellbarnesphoto.com
daghidelivery.com
daturanatura.com
royaltylashesnola.com
meemtee.com
stevenemily.com
hessbbqsweeps.com
worldofannabel.com
best-tuning.com
ichaugames.com
doctors4change.net
haoshi68.com
yourrealestaterealtor.com
schekerland.com
siguelacorriente.com
rockthomasonline.com
amewolf.com
bawakamus.online
puntopymeschile.com
empiricalmystic.com
hxc28.com
nzessential.com
jennamariehoward.com
pranatarot.com

Targets

- Target
  FORMULARIO DE PROVEEDOR.exe
- Size 425KB
- SHA256 cb15e1a8f3339acd45d00adabdffef0ed9f169f0df0080c7f373396c16652236
- MD5 30e2973d62b11bd535b4eb7d18b044f8
- SHA1 91ef667022de5e726d9858752690cc390bc06366
- SHA512 20cf26abac7a550abfcfc1a7613bc4c1f9b25283a8359fc5ba382ad0907d2d55e068a96dbe5a2a12c69ffd357a8120275880fb6011a6d374f70110f739f668a7
- MD5 SHA1 SHA512
Score

10^/10

xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2