Overview

overview

10

Static

static

PO#4500491796.exe

windows7_x64

10

PO#4500491796.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#4500491796.exe

  • Size

    944KB

  • Sample

    210824-t9t5x7qjf2

  • MD5

    e5d92d9d8c8b6bea5fff7c0fb1c2e21a

  • SHA1

    46ffd28bced83a839042d7a49e30b8821fdaa353

  • SHA256

    35517ca8e7a66a88a7243724e6c374d0a4a82878792536087f746bf33ab2bddf

  • SHA512

    393ed37b97aa04abc7c92f4d7ba92725c5f33441f5747d6c9939ccce998c207c6e7fc8c657a2523fed56ebeddfffcf0cd57822b922f8c30a2aeb080a5fefc2e3

Score
10/10
xloadern58iloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n58i

C2

http://www.mack3sleeve.com/n58i/

Decoy

nl-cafe.com

votetedjaleta.com

britrobertsrealtor.com

globipark.com

citysucces.com

verisignwebsite-verified.com

riddlepc.com

rosecityclimbing.com

oleandrinextract.com

salmankonstruksi.com

needhamchannel.com

refreshx2z.com

youth66.com

pla-russia.com

halloweenmaskpro.com

exdysis.com

1gcz.com

lookgoodman.com

rlxagva.com

stlcityc.com

Targets

    • Target

      PO#4500491796.exe

    • Size

      944KB

    • MD5

      e5d92d9d8c8b6bea5fff7c0fb1c2e21a

    • SHA1

      46ffd28bced83a839042d7a49e30b8821fdaa353

    • SHA256

      35517ca8e7a66a88a7243724e6c374d0a4a82878792536087f746bf33ab2bddf

    • SHA512

      393ed37b97aa04abc7c92f4d7ba92725c5f33441f5747d6c9939ccce998c207c6e7fc8c657a2523fed56ebeddfffcf0cd57822b922f8c30a2aeb080a5fefc2e3

    Score
    10/10
    xloadern58iloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks