Overview

overview

10

Static

static

1

New Order.exe

windows7_x64

10

New Order.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order.exe

  • Size

    208KB

  • Sample

    210505-n68danm82x

  • MD5

    e3ef839d952e85b861b7b15faad53f8e

  • SHA1

    feec9cf7cd91f7d3ba245388ff4655f5b3aecf21

  • SHA256

    d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4

  • SHA512

    91b5018a2fcb8a758f9a4d76a005095035e7f90b91d71eba345e0f3ab625c4479172e5b580cac4713643f2162feacfc66a7a983d32cf0c7e47862862a956dc5f

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Targets

    • Target

      New Order.exe

    • Size

      208KB

    • MD5

      e3ef839d952e85b861b7b15faad53f8e

    • SHA1

      feec9cf7cd91f7d3ba245388ff4655f5b3aecf21

    • SHA256

      d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4

    • SHA512

      91b5018a2fcb8a758f9a4d76a005095035e7f90b91d71eba345e0f3ab625c4479172e5b580cac4713643f2162feacfc66a7a983d32cf0c7e47862862a956dc5f

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks