Overview

overview

10

Static

static

b092672d7f...ca.exe

windows7_x64

10

b092672d7f...ca.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b092672d7f36d3deaab664c0a562b055f9cee3f247328e639aca58f025f979ca.zip

  • Size

    408KB

  • Sample

    210921-avmq4sffe7

  • MD5

    45ce6a1195a842497365258b706e319a

  • SHA1

    2afa306daefdf66f760cfb2b96b8eca040932242

  • SHA256

    8381d19dc58f90b1128943d60b41930dd0619f4a7ef0f2940aff2f5f8c234627

  • SHA512

    019a6f0ec3003a363ffbd8ea00875454c33d78e832c35e322641af56acb80c3a46a9288195f0a4e9d4b676342be8fd1dd19dea014d77975e7a776b26a44d6b4f

Score
10/10
xloadern58iloaderrat

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

n58i

C2

http://www.nordicbatterybelt.net/n58i/

Decoy

southerncircumstance.com

mcsasco.com

ifbrick.com

societe-anonyme.net

bantank.xyz

dogecoin.beauty

aboutacoffee.com

babalandlordrealestate.com

tintgta.com

integrity.directory

parwnr.icu

poltishof.online

stayandstyle.com

ickjeame.xyz

currentmotors.ca

pond.fund

petrosterzis.com

deadbydaylightpoints.com

hotel-balzac.paris

focusmaintainance.com

Targets

    • Target

      b092672d7f36d3deaab664c0a562b055f9cee3f247328e639aca58f025f979ca

    • Size

      480KB

    • MD5

      66fc712a2dc1321fa0fc6bdf8bcd82a5

    • SHA1

      7870ac22e3c8233430e0c5df62c72397f29e1294

    • SHA256

      b092672d7f36d3deaab664c0a562b055f9cee3f247328e639aca58f025f979ca

    • SHA512

      d0c101943eb61750234a838e1c5b2571996c64c5f0800272656d74e79dd60e9737e3c5326978ff6dacdd32bde71b88b46e0b4b9e87cde7e09f1246bb3667e7d7

    Score
    10/10
    xloadern58iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks