Overview

overview

10

Static

static

1

SWIFT 00395_IMG.exe

windows7_x64

10

SWIFT 00395_IMG.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SWIFT 00395_IMG.exe

  • Size

    13.4MB

  • Sample

    210504-68xzxh96mn

  • MD5

    f19e6012ff248b9b380bb420080258ce

  • SHA1

    317ee43a8116aae39f3de3279620ecff4ac05b2c

  • SHA256

    069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52

  • SHA512

    ad555d5a6bbd753825fba4a4665b4774d88f4011f3c7c6a2c0084fd40e59d66d2880b4a390cc8a172e51b67f8198d0fa481a981c916025f1642ace15c5ab1cdf

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.seroungift.com/bbqo/

Decoy

theinfluenstar.com

1800quilts.com

sonsuz-muzik.com

manilowsmodems.com

amwajcare.com

eam.email

cscosmos.com

tierraovens.com

goimtv.com

checks4d.com

beijig.com

szzyhjj.com

huanchunjx.com

catqq.one

vendasuascartas.com

cannatends.com

cytotecobatpenggugur.com

centralvalleypartners4youth.com

entreforma.com

azhathai.com

Targets

    • Target

      SWIFT 00395_IMG.exe

    • Size

      13.4MB

    • MD5

      f19e6012ff248b9b380bb420080258ce

    • SHA1

      317ee43a8116aae39f3de3279620ecff4ac05b2c

    • SHA256

      069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52

    • SHA512

      ad555d5a6bbd753825fba4a4665b4774d88f4011f3c7c6a2c0084fd40e59d66d2880b4a390cc8a172e51b67f8198d0fa481a981c916025f1642ace15c5ab1cdf

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks