Overview

overview

10

Static

static

1

51c46cfdcb...b3.exe

windows7_x64

10

51c46cfdcb...b3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51c46cfdcb94cf241595e99600ba40b3.exe

  • Size

    289KB

  • Sample

    210929-lw7y8aeegk

  • MD5

    51c46cfdcb94cf241595e99600ba40b3

  • SHA1

    00ca9779115daee4f009d1048994270e5d9f86ab

  • SHA256

    81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596

  • SHA512

    75cc385fd4b22d55cd5b89b417b81abe98689e6cad7977ca8eb2348a74eb54f60f53868f3e4d08ac47dfc79553ee78e41bc0c6f51d98a87b14ad78bd00b6cb63

Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Targets

    • Target

      51c46cfdcb94cf241595e99600ba40b3.exe

    • Size

      289KB

    • MD5

      51c46cfdcb94cf241595e99600ba40b3

    • SHA1

      00ca9779115daee4f009d1048994270e5d9f86ab

    • SHA256

      81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596

    • SHA512

      75cc385fd4b22d55cd5b89b417b81abe98689e6cad7977ca8eb2348a74eb54f60f53868f3e4d08ac47dfc79553ee78e41bc0c6f51d98a87b14ad78bd00b6cb63

    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks