Overview

overview

10

Static

static

doc_391200...50.scr

windows7_x64

10

doc_391200...50.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    doc_391200004532000450.scr

  • Size

    899KB

  • Sample

    210506-y2wxdbf3rn

  • MD5

    1e1f169ac3fc87ad55252f38cad083bb

  • SHA1

    ec778acec7bfe578f6d13556765e5ed5ba0a405b

  • SHA256

    6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48

  • SHA512

    edad0f0ec3c9b0daebbd7ab17ab182cdeabb3fad0ba0d08a2191f1007f41b8cf995ed9082fa3439857065900a1ed3b5c73091113aa8bb6dc3db6813ebf24ee35

Score
10/10
xloaderloaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.austinenglishtutor.com/ipio/

Decoy

fatiguemanager.co.uk

malignment.com

fashionashton.com

soawstservices.com

gardengarages.com

affirm.digital

savetheboxes.com

stepupjam.net

sassyfurbaby.com

rarecares.institute

hisarsteel.com

thespotifygrowthguide.com

111indianbend.com

kizilaykorkuevi.com

zeegostar.com

scuolateatroarsenale.com

dyaspaar.com

no1jt.com

gain2020live.com

dearhim.com

Targets

    • Target

      doc_391200004532000450.scr

    • Size

      899KB

    • MD5

      1e1f169ac3fc87ad55252f38cad083bb

    • SHA1

      ec778acec7bfe578f6d13556765e5ed5ba0a405b

    • SHA256

      6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48

    • SHA512

      edad0f0ec3c9b0daebbd7ab17ab182cdeabb3fad0ba0d08a2191f1007f41b8cf995ed9082fa3439857065900a1ed3b5c73091113aa8bb6dc3db6813ebf24ee35

    Score
    10/10
    xloaderloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks