Overview

overview

10

Static

static

1

PO.exe

windows7_x64

10

PO.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.exe

  • Size

    225KB

  • Sample

    210624-swedkrkdba

  • MD5

    42a437dc06eea16fa8adaa67e08091d4

  • SHA1

    4e3ecf96e002babd033d12183493e45747a179b4

  • SHA256

    660708a7f99d26de87386ca21682b96179f16f2dbc67578a704cb94d78e9848f

  • SHA512

    0dc7c2308ccdd6e31e9fc1f31d06dc1113a5153cd6cdd71094e08f216fbbc62af0775b404cbb12b03eeb4ab6f59c92930c0404ac136d94ccd7f711bc9c6bfe44

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.mertztaxprep.com/ubuq/

Decoy

lockielan.com

maltaprefix.icu

smarteryou6g1.club

paulinequinonero.com

bluezonephysiotherapy.com

xbikinix.com

kleverfilms.com

zsintion60.com

clawlabs.com

promositransvision.com

toesinthesandwedding.com

superkiski.com

2385jsdfndsd.life

consultingthehive.com

blockchainskillslab.com

zeuzcreative.com

szkemijx.com

mikenewellhomes.com

xywehwpibm.net

forevervalley.com

Targets

    • Target

      PO.exe

    • Size

      225KB

    • MD5

      42a437dc06eea16fa8adaa67e08091d4

    • SHA1

      4e3ecf96e002babd033d12183493e45747a179b4

    • SHA256

      660708a7f99d26de87386ca21682b96179f16f2dbc67578a704cb94d78e9848f

    • SHA512

      0dc7c2308ccdd6e31e9fc1f31d06dc1113a5153cd6cdd71094e08f216fbbc62af0775b404cbb12b03eeb4ab6f59c92930c0404ac136d94ccd7f711bc9c6bfe44

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks