Overview

overview

10

Static

static

PAYMENT IN...PY.exe

windows7_x64

10

PAYMENT IN...PY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PAYMENT INSTRUCTIONS COPY.exe

  • Size

    902KB

  • Sample

    210511-p13tpxq7gn

  • MD5

    21e8676fede4e9e629ac0b0e36a3772a

  • SHA1

    2643fb666f938fbdc0ce81994629a2ad152451af

  • SHA256

    6716f9ca37043f0684164a12c5971f67c738cefb8b8322556d970f60333d72b0

  • SHA512

    e527eec19599469bbecb64f502279a68b969920a3828524fdd455d232b3e9fdb14e4cda89623250ea6483113043ff48fa1fbe72c1b46c9ce5a0992661da00a54

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.ursulaaubri.com/s5cm/

Decoy

labibmasas.com

puppy-os.com

campingquick.com

bluewavewelding.com

qizhukeji.com

economiemalin.com

tomrings.com

mdduct.com

cloodgame.com

acadiepresse.com

daleradio.net

kampanyalisayfalar.digital

instrumentsets.com

centralcoastcardeals.com

xn--fiqyww2q3xd.xyz

annafelicia.com

vinkle.net

somebodyelsesdesigns.com

thatsohaute.com

gaoxiaoduan.com

Targets

    • Target

      PAYMENT INSTRUCTIONS COPY.exe

    • Size

      902KB

    • MD5

      21e8676fede4e9e629ac0b0e36a3772a

    • SHA1

      2643fb666f938fbdc0ce81994629a2ad152451af

    • SHA256

      6716f9ca37043f0684164a12c5971f67c738cefb8b8322556d970f60333d72b0

    • SHA512

      e527eec19599469bbecb64f502279a68b969920a3828524fdd455d232b3e9fdb14e4cda89623250ea6483113043ff48fa1fbe72c1b46c9ce5a0992661da00a54

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks