xloader

Sharing

Copy URL Twitter E-mail

General

Target
ce2507ea9bf81d82d5df1b6878b95fc4
Size 684KB
Sample210830-41fs2hdmzx
SHA256 84fe246796952c9de41a5c2355bfbcb0dbea52f3e107395c8f40d3eec500cacf
MD5 ce2507ea9bf81d82d5df1b6878b95fc4
SHA1 81f4988663a4a730b3611273324c06e53a4b56c3
SHA512 7d45955d51b7c070f54164fabf75d3c9988c351420ac2a50023bce7f37612415ad82781c7c65c8edb678193b96e759feaa1829bc3ccb3f8732dbc09b670e26b9
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

n8ba

http://www.narrowpathwc.com/n8ba/

Decoy

thefitflect.com
anytourist.com
blggz.xyz
ascope.club
obyeboss.com
braun-mathematik.online
mtsnurulislamsby.com
jwpropertiestn.com
animalds.com
cunerier.com
sillysocklife.com
shopliyonamaaghin.net
theredcymbalsco.com
lostbikeproject.com
ryggoqlmga.club
realestatetriggers.com
luvlauricephotography.com
cheesehome.cloud
5fashionfix.net
wata-6-rwem.net
ominvestment.net
rrinuwsq643do2.xyz
teamtacozzzz.com
newjerseyreosales.com
theresahovo.com
wowmovies.today
77k6tgikpbs39.net
americagoldenwheels.com
digitaladbasket.com
gcagame.com
arielatkins.net
2020coaches.com
effthisshit.com
nycabl.com
fbvanminh.com
lovebirdsgifts.com
anxietyxpill.com
recaptcha-lnc.com
aprendelspr.com
expatinsur.com
backtothesimplethings.com
pcf-it.services
wintonplaceoh.com
designermotherhood.com
naamt.com
lifestylebykendra.com
thehighstatusemporium.com
oneninelacrosse.com
mariasmoworldwide.com
kitesurf-piraten.net
atelierbond.com
mynjelderlaw.com
moucopia.com
hauhome.club
imroundtable.com
thralink.com
baoequities.com
nassy.cloud
goldenstatelabradoodles.com
revenueremedyintensive.com
dfendglobal.com
pugliaandgastronomy.com
cypios.net
trinioware.com

Targets

- Target
  ce2507ea9bf81d82d5df1b6878b95fc4
- Size 684KB
- SHA256 84fe246796952c9de41a5c2355bfbcb0dbea52f3e107395c8f40d3eec500cacf
- MD5 ce2507ea9bf81d82d5df1b6878b95fc4
- SHA1 81f4988663a4a730b3611273324c06e53a4b56c3
- SHA512 7d45955d51b7c070f54164fabf75d3c9988c351420ac2a50023bce7f37612415ad82781c7c65c8edb678193b96e759feaa1829bc3ccb3f8732dbc09b670e26b9
- MD5 SHA1 SHA512
Score

10^/10

xloader n8ba loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2