Overview

overview

10

Static

static

1

P.O.exe

windows7_x64

10

P.O.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5b7bb9c_by_Libranalysis

  • Size

    192KB

  • Sample

    210505-ck4hh4jlxa

  • MD5

    e5b7bb9c918d0109d6aa1115aa8ac4b1

  • SHA1

    b92caed963b85d06f5d6648072b750b6f79809d5

  • SHA256

    bfcba701c60d864983f5b9c9b5975f8933e650cc426decbef8180f740a10b9fe

  • SHA512

    5e9aa1b780d4fc9dda2af931487ddf4c03b3618b6cb9cc23af9489697b4c5dac3270fa980a66bd3e6f2594a01a06ffcf8f678e4ff5802bc43ca810d16b85e133

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Targets

    • Target

      P.O.exe

    • Size

      207KB

    • MD5

      eb71efe60cabc2d6aa9a49a82a4ded77

    • SHA1

      c188402835e985adac142eee6e0b31fd4c0c0ae6

    • SHA256

      9b70fcd07ba7d3dcef17f3b28cf75e304840a67e8611dc149744215f8483066d

    • SHA512

      3654b1ff3b57ca883b6fc6d086a8c90654f3e59f2efbe7341677ac85216bc8c1d2bc448940081eb9852f10f43a51d71f4eeef05445e046b9726108f792bdc1c2

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks