Overview

overview

10

Static

static

BL01345678053567.exe

windows7_x64

10

BL01345678053567.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BL01345678053567.exe

  • Size

    44KB

  • Sample

    210408-3yrpj997fe

  • MD5

    34f07a647ee6506ce224b934e0c53d46

  • SHA1

    f2063199535bc94679ff93ac54fde30927e9f3a0

  • SHA256

    d3df1a5eed27cd76b426b3b041bf7acd61e50276461c888cf761f3fbd1cf06db

  • SHA512

    0df0314cea9acf6a8c3ce9510c74781abc5f54b05ced0a974dc611a0f5b4a6d18da27ee4b9fb7ba6ffcabc1ff7ef183a5220a5b8a2ae83da752382f94666d71b

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.hnchotels.com/mb7q/

Decoy

thezensub.com

wapedir.com

itt.xyz

mindframediscovery.com

sitesolved.net

beyju.store

belatopapparel.xyz

ridgefitct.com

huanb.com

brustwarzentattoo.com

jlasoluciones.club

sinoagrifcf.com

theskineditco.com

ccsdinstructer.com

wealththinker.com

pradnyanamaya.com

szmsbk.com

meezingo.com

ivyshermanboutique.com

tkbeads.com

Targets

    • Target

      BL01345678053567.exe

    • Size

      44KB

    • MD5

      34f07a647ee6506ce224b934e0c53d46

    • SHA1

      f2063199535bc94679ff93ac54fde30927e9f3a0

    • SHA256

      d3df1a5eed27cd76b426b3b041bf7acd61e50276461c888cf761f3fbd1cf06db

    • SHA512

      0df0314cea9acf6a8c3ce9510c74781abc5f54b05ced0a974dc611a0f5b4a6d18da27ee4b9fb7ba6ffcabc1ff7ef183a5220a5b8a2ae83da752382f94666d71b

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks