xloader

General

Target

716f61cba6d08cd0c1904bcc827b56a0.exe
Size

207KB
Sample

210503-v3cv2q1f3s
MD5

716f61cba6d08cd0c1904bcc827b56a0
SHA1

357a1acb28174392e191716972537555790ae792
SHA256

2833ffeca48c46759cb0d4c984e81a9b69614c368bf0052600786e55fd534d67
SHA512

6b392de718dca8d95b05f06a466b9e52ad0f757fef81a6237b541563f60cb2238ea5f451fe6ed4ca1edb9ba8af14318ea3c6d6708e456273544ddfdd5328d24e

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Targets

- Target
  
  716f61cba6d08cd0c1904bcc827b56a0.exe
- Size
  
  207KB
- MD5
  
  716f61cba6d08cd0c1904bcc827b56a0
- SHA1
  
  357a1acb28174392e191716972537555790ae792
- SHA256
  
  2833ffeca48c46759cb0d4c984e81a9b69614c368bf0052600786e55fd534d67
- SHA512
  
  6b392de718dca8d95b05f06a466b9e52ad0f757fef81a6237b541563f60cb2238ea5f451fe6ed4ca1edb9ba8af14318ea3c6d6708e456273544ddfdd5328d24e
Score

10^/10

xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2