Overview

overview

10

Static

static

1

f9d0f03aba...9a.exe

windows7_x64

10

f9d0f03aba...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9d0f03aba5378393fe83fa8e473b89a.exe

  • Size

    493KB

  • Sample

    210929-hzdyrsdhf2

  • MD5

    f9d0f03aba5378393fe83fa8e473b89a

  • SHA1

    174def16b7a286eeb3f97f68817ab393414ac5fc

  • SHA256

    64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d

  • SHA512

    c2b21c01fe2af50c3358e61d7a81cf4889fe34b222ee555a487e93f73f57f8392a3947ab3572f10c2df3b7444e4b3b2f520c6bae8effb50bf1014ca0a40bcb3b

Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Targets

    • Target

      f9d0f03aba5378393fe83fa8e473b89a.exe

    • Size

      493KB

    • MD5

      f9d0f03aba5378393fe83fa8e473b89a

    • SHA1

      174def16b7a286eeb3f97f68817ab393414ac5fc

    • SHA256

      64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d

    • SHA512

      c2b21c01fe2af50c3358e61d7a81cf4889fe34b222ee555a487e93f73f57f8392a3947ab3572f10c2df3b7444e4b3b2f520c6bae8effb50bf1014ca0a40bcb3b

    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks