Overview

overview

10

Static

static

1

62c72f781d...32.exe

windows7_x64

10

62c72f781d...32.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62c72f781d7001dff6d747ee91e33e32.exe

  • Size

    262KB

  • Sample

    210923-g5gfeafbb4

  • MD5

    62c72f781d7001dff6d747ee91e33e32

  • SHA1

    ed9fb1d769fd4655a335884d26875758fe67433c

  • SHA256

    990a8fa7e96d2cd90b09ab39794df984bc153d0dcd390afbca19a42b689d4e7d

  • SHA512

    2b4e491681ddeebbf0eadb0f86923cedd6bc22c168c33aaa0363069df317a6bf5bde74f614abc97dde35185aa8f1f8fd5c0340a4b4c509fdf3f1837bbfb6473d

Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Targets

    • Target

      62c72f781d7001dff6d747ee91e33e32.exe

    • Size

      262KB

    • MD5

      62c72f781d7001dff6d747ee91e33e32

    • SHA1

      ed9fb1d769fd4655a335884d26875758fe67433c

    • SHA256

      990a8fa7e96d2cd90b09ab39794df984bc153d0dcd390afbca19a42b689d4e7d

    • SHA512

      2b4e491681ddeebbf0eadb0f86923cedd6bc22c168c33aaa0363069df317a6bf5bde74f614abc97dde35185aa8f1f8fd5c0340a4b4c509fdf3f1837bbfb6473d

    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks