xloader | 9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4 | Triage

Sharing

General

Target

9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4
Size

1.1MB
Sample

210821-yc1rvgtxrn
MD5

14035831d9b086963a7ab5d7fef18c6a
SHA1

75df72d00fa15487a590f569a5039cd1f1feff63
SHA256

9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4
SHA512

e597ce0f0f3ef763eb229c8a04136b7f7f01144c1732ccbd62e131e99ddacfb6364c59ecd41953cdce0420b910335895b565085018e5ab0b91142c6f9deb061c

Score

10^/10

xloader n8ba loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n8ba

C2

http://www.narrowpathwc.com/n8ba/

Decoy

thefitflect.com

anytourist.com

blggz.xyz

ascope.club

obyeboss.com

braun-mathematik.online

mtsnurulislamsby.com

jwpropertiestn.com

animalds.com

cunerier.com

sillysocklife.com

shopliyonamaaghin.net

theredcymbalsco.com

lostbikeproject.com

ryggoqlmga.club

realestatetriggers.com

luvlauricephotography.com

cheesehome.cloud

5fashionfix.net

wata-6-rwem.net

Targets

- Target
  
  9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4
- Size
  
  1.1MB
- MD5
  
  14035831d9b086963a7ab5d7fef18c6a
- SHA1
  
  75df72d00fa15487a590f569a5039cd1f1feff63
- SHA256
  
  9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4
- SHA512
  
  e597ce0f0f3ef763eb229c8a04136b7f7f01144c1732ccbd62e131e99ddacfb6364c59ecd41953cdce0420b910335895b565085018e5ab0b91142c6f9deb061c
Score

10^/10

xloader n8ba loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xloadern8baloaderrat