Overview

overview

10

Static

static

1

raw f.exe

windows7_x64

10

raw f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    raw f.exe

  • Size

    208KB

  • Sample

    210430-61v6letgjs

  • MD5

    319f554641bef914792208e976030780

  • SHA1

    111fd72e1f312727754f784a0da9b1a98fb4a00b

  • SHA256

    ec2271f9e6e57b84cae0e6df2af197a02133e5644d55eb3d2be373681397f919

  • SHA512

    a3f900284c9295e3378f291e41b7ddec4316c6916ba54b8fb7f448acda4c44bf9ec0331287a03b719ff451e9380b9a790cb7a60cb926103a97cd8617b3c2be6b

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.citestaccnt1597666144.com/ud9e/

Decoy

casezs.com

gascubby.com

pekodains.com

superskosh.com

avktinfracon.com

slink.finance

thegreathopeofearth.com

thebattleofthestars.com

utmxpxq.icu

mamaandbabycleaningservice.com

officialtimelessbeauty.com

keeper.network

leyingcp.com

helpforharrysheroes.com

cohenforleehealthboard.com

wsilhavy.net

logisticsconsultinglimited.com

btechnician.com

dynamicpersiankitten.com

nuplaz.com

Targets

    • Target

      raw f.exe

    • Size

      208KB

    • MD5

      319f554641bef914792208e976030780

    • SHA1

      111fd72e1f312727754f784a0da9b1a98fb4a00b

    • SHA256

      ec2271f9e6e57b84cae0e6df2af197a02133e5644d55eb3d2be373681397f919

    • SHA512

      a3f900284c9295e3378f291e41b7ddec4316c6916ba54b8fb7f448acda4c44bf9ec0331287a03b719ff451e9380b9a790cb7a60cb926103a97cd8617b3c2be6b

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks