Overview

overview

10

Static

static

xvhostb.exe

windows7_x64

10

xvhostb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xvhostb.exe

  • Size

    611KB

  • Sample

    210421-4tt8byqqlj

  • MD5

    a1d6e3ac3ee1adbbc7a16e5f7d7cac1d

  • SHA1

    c389f7fe73ba9c75d391c9f9c2bcff87c51556c7

  • SHA256

    c076e25acd902f35a52bdb12240494e39df85412b09111e451afdc584487b5df

  • SHA512

    d247593dcf889544745ff02599f8094811a83a159c9818c377b00ff39daa68be8125f799d23074b57e2ddfeb878b5d68615e3f258e646164aca98c19dba5807b

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.allindiatrust.com/sbjq/

Decoy

topbrandslook.xyz

kupilabs.com

cedrick.net

91mh.info

ajoph.net

finishtheverse.com

pondokquranaljariyah.com

happyhoopoe.com

lowcostfooddelivery.com

estudiosvacunacovid19-co.com

iestradanhhome.com

xn--caasymas-e3a.com

shopqls.com

wpnator.com

parentedagency.com

nundmshop.com

lodosmimarlik.com

ccidyy.xyz

bem-vestida.com

smartincomeafrica.com

Targets

    • Target

      xvhostb.exe

    • Size

      611KB

    • MD5

      a1d6e3ac3ee1adbbc7a16e5f7d7cac1d

    • SHA1

      c389f7fe73ba9c75d391c9f9c2bcff87c51556c7

    • SHA256

      c076e25acd902f35a52bdb12240494e39df85412b09111e451afdc584487b5df

    • SHA512

      d247593dcf889544745ff02599f8094811a83a159c9818c377b00ff39daa68be8125f799d23074b57e2ddfeb878b5d68615e3f258e646164aca98c19dba5807b

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks