Overview

overview

10

Static

static

GLEASON_QT2309.exe

windows7_x64

10

GLEASON_QT2309.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GLEASON_QT2309.exe

  • Size

    642KB

  • Sample

    210924-nf5j9sggf6

  • MD5

    d601604552146dd9a412f1db8ff0cdd4

  • SHA1

    8dc649c53d100c5d1f1330dc5ba33c680208d7f8

  • SHA256

    3121d773a680fbac7dc37f75c38ae8ef20f1b88915cc0b83ca9bf2bf7c22ee94

  • SHA512

    ae739f1a3ec1b0890dfc46a2b5d88e8cf211ecbc462539a1878e25c33c081ada166d1ad09bf859dd8e83f246d73b7bc9cf5c9f75465be7b09b0566aae50ebc34

Score
10/10
xloaderg9vgloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

g9vg

C2

http://www.supra413.com/g9vg/

Decoy

selenebrennan.com

htsfrance.com

monsieurtechno.com

argosy.city

lit-clouds.com

emilio-m.com

crashycraft.net

washmebro.com

1houroflife.com

millershaga.com

newtonpod.com

camopants.net

animator-show.com

qqzome.com

assetacre.com

letsmakeyourchoice.com

gileadpreferences.com

ecomarklifestyle.com

mivaautomotive.com

rattle100.com

Targets

    • Target

      GLEASON_QT2309.exe

    • Size

      642KB

    • MD5

      d601604552146dd9a412f1db8ff0cdd4

    • SHA1

      8dc649c53d100c5d1f1330dc5ba33c680208d7f8

    • SHA256

      3121d773a680fbac7dc37f75c38ae8ef20f1b88915cc0b83ca9bf2bf7c22ee94

    • SHA512

      ae739f1a3ec1b0890dfc46a2b5d88e8cf211ecbc462539a1878e25c33c081ada166d1ad09bf859dd8e83f246d73b7bc9cf5c9f75465be7b09b0566aae50ebc34

    Score
    10/10
    xloaderg9vgloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks