xloader

Resubmissions

13-08-2021 08:02

210813-2dkl9smx9n 10

12-08-2021 10:21

210812-extrs4cn96 10

Sharing

Copy URL

Twitter E-mail

General

Target

Balance payment advice.exe
Size

1.4MB
Sample

210812-extrs4cn96
MD5

7a4ee3c9e3e9105814a2c02a6e326055
SHA1

dc62122e0ace285034495d9be8185636de5540bf
SHA256

4d7e4cedde9a2c613ef907b1fd8c9790e349ae738350d90cfb6c129ef689c159
SHA512

a9d206d70586629fa5f07889575caff833858640dae6f0874d30f8280723a8a99138e374bd0d767c91a31492c928613bad17b1be756e2afe4caba87e0ac53399

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

bp39

http://www.piadineriae45.com/bp39/

Decoy

glembos.com

adjud.net

beautifyoils.com

chilewiki.com

duxingzi.com

happygromedia.com

restpostenboerse.com

vowsweddingofficiants.com

ladingjiwa.xyz

keepmakingefforts-001.com

yeniao.net

eyildirmaz.com

sayanghae.com

promoteboost.com

lzft.net

proudindiacompany.com

birchwoodmeridianlink.com

mesinionisasi.com

wwwrigalinks.com

wewearthepants.com

Targets

- Target
  
  Balance payment advice.exe
- Size
  
  1.4MB
- MD5
  
  7a4ee3c9e3e9105814a2c02a6e326055
- SHA1
  
  dc62122e0ace285034495d9be8185636de5540bf
- SHA256
  
  4d7e4cedde9a2c613ef907b1fd8c9790e349ae738350d90cfb6c129ef689c159
- SHA512
  
  a9d206d70586629fa5f07889575caff833858640dae6f0874d30f8280723a8a99138e374bd0d767c91a31492c928613bad17b1be756e2afe4caba87e0ac53399
Score

10^/10

xloader bp39 loader rat suricata
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata: ET MALWARE FormBook CnC Checkin (GET)
  suricata
- Xloader Payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE FormBook CnC Checkin (GET)

Xloader Payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2