Overview

overview

10

Static

static

1

196ef716e5...5e.exe

windows7_x64

10

196ef716e5...5e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    196ef716e51eb90f7ffcfd2219ce1d5e.exe

  • Size

    253KB

  • Sample

    210927-kg44cagbf3

  • MD5

    196ef716e51eb90f7ffcfd2219ce1d5e

  • SHA1

    3c5d438cb3dee2b0474ea45be67069db184e26bb

  • SHA256

    c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb

  • SHA512

    e303bd36a6cd409bf146b0716a52c50ab5069b3dd513303a8c63c1494013450e5a84ee0bf7eb5d7396946080f57ef08275e09326bc2bd3fc80f94f911e872759

Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Targets

    • Target

      196ef716e51eb90f7ffcfd2219ce1d5e.exe

    • Size

      253KB

    • MD5

      196ef716e51eb90f7ffcfd2219ce1d5e

    • SHA1

      3c5d438cb3dee2b0474ea45be67069db184e26bb

    • SHA256

      c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb

    • SHA512

      e303bd36a6cd409bf146b0716a52c50ab5069b3dd513303a8c63c1494013450e5a84ee0bf7eb5d7396946080f57ef08275e09326bc2bd3fc80f94f911e872759

    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks