xloader

General

Target

1edfdb02b75931f824ee82640283671be10398b4
Size

205KB
Sample

210507-8mqxejpsr6
MD5

c30480523e2f0d910f78aea742cb9c3a
SHA1

1edfdb02b75931f824ee82640283671be10398b4
SHA256

2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5
SHA512

ad5289ced6ec2757af225d7830cab9684ee6e2a00a2088626d29b1d100920fde69062932d351d9d4a946ca269f4ba89800ad2ba02c198940204f94584c63b94d

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Targets

- Target
  
  1edfdb02b75931f824ee82640283671be10398b4
- Size
  
  205KB
- MD5
  
  c30480523e2f0d910f78aea742cb9c3a
- SHA1
  
  1edfdb02b75931f824ee82640283671be10398b4
- SHA256
  
  2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5
- SHA512
  
  ad5289ced6ec2757af225d7830cab9684ee6e2a00a2088626d29b1d100920fde69062932d351d9d4a946ca269f4ba89800ad2ba02c198940204f94584c63b94d
Score

10^/10

xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2