Overview

overview

10

Static

static

10

xloader

macos_amd64

10

Resubmissions

02/09/2021, 14:41

210902-r2t77sadd510

26/08/2021, 20:08

210826-x63p7evsw610

26/08/2021, 17:01

210826-hhfzsjhlaj10

Analysis

  • max time network
    152s
  • platform
    macos_amd64
  • resource
    macos
  • submitted
    02/09/2021, 14:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xloader
  • Size 124KB
  • Sample210902-r2t77sadd5
  • SHA256 46adfe4740a126455c1a022e835de74f7e3cf59246ca66aa4e878bf52e11645d
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 1 IoCs
    rat

Processes

  • /bin/sh
    sh -c "sudo /Users/run/xloader"
    1⤵
      PID:464
    • /bin/bash
      sh -c "sudo /Users/run/xloader"
      1⤵
        PID:464
      • /usr/bin/sudo
        sudo /Users/run/xloader
        1⤵
          PID:464
          • /Users/run/xloader
            /Users/run/xloader
            2⤵
              PID:466
          • /bin/sh
            sh -c /var/root/.gJSXgBp/DvEpBdIXQp.app/Contents/MacOS/DvEpBdIXQp
            1⤵
              PID:467
            • /bin/bash
              sh -c /var/root/.gJSXgBp/DvEpBdIXQp.app/Contents/MacOS/DvEpBdIXQp
              1⤵
                PID:467
              • /var/root/.gJSXgBp/DvEpBdIXQp.app/Contents/MacOS/DvEpBdIXQp
                /var/root/.gJSXgBp/DvEpBdIXQp.app/Contents/MacOS/DvEpBdIXQp
                1⤵
                  PID:467

                Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads