Overview

overview

10

Static

static

1

259c7a6403...b8.exe

windows7_x64

10

259c7a6403...b8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    259c7a6403af1553ed0436fbf9e592b8.exe

  • Size

    262KB

  • Sample

    210921-x5jhrsdagk

  • MD5

    259c7a6403af1553ed0436fbf9e592b8

  • SHA1

    b0aa55e4f8a14c48f844a3e90e9ba74e476fe0de

  • SHA256

    64c00be3d0bc5f000ee6d2d6d49e72c9e9f36090f19b7f9620ff0993a0e84025

  • SHA512

    e48738b38934fb0f8c94f9f81d8448e610ab02d0819897e7be66d082154828681d9603c51d5dffd7224c2d9d1df35c97f70056df20b73a665447318d576cee37

Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Targets

    • Target

      259c7a6403af1553ed0436fbf9e592b8.exe

    • Size

      262KB

    • MD5

      259c7a6403af1553ed0436fbf9e592b8

    • SHA1

      b0aa55e4f8a14c48f844a3e90e9ba74e476fe0de

    • SHA256

      64c00be3d0bc5f000ee6d2d6d49e72c9e9f36090f19b7f9620ff0993a0e84025

    • SHA512

      e48738b38934fb0f8c94f9f81d8448e610ab02d0819897e7be66d082154828681d9603c51d5dffd7224c2d9d1df35c97f70056df20b73a665447318d576cee37

    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks