Overview

overview

10

Static

static

1

f51da2ac8c...14.exe

windows7_x64

10

f51da2ac8c...14.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f51da2ac8cdfc1ff41921f0fceee4514

  • Size

    440KB

  • Sample

    211005-hv18hahffp

  • MD5

    f51da2ac8cdfc1ff41921f0fceee4514

  • SHA1

    f910ed6637480ff6930df72d9258029641a186ba

  • SHA256

    f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175

  • SHA512

    830f6fadf25b3b839d648a71e82eb3fb37c0e5376d5ce76044a39321ab54f356cec4f9a8ef08f01ebe2d86b6e6643a24a591b680ab2f88c29ecb8e43e837ed46

Score
10/10
xloadernohaloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

noha

C2

http://www.mglracing.com/noha/

Decoy

iphone13promax.support

trailer-racks.xyz

overseaspoolservice.com

r2d2u.com

dawajeju.com

nextgenproxyvote.com

xn--vhqp8mm8dbtz.group

commonsenserisk.com

cmcqgxtyd.com

data2form.com

bois-applique.com

originallollipop.com

lj0008lj.net

spfldvaccineday.info

phalcosnusa.com

llcmastermachine.com

onlyforu14.rest

bestmarketingautomations.com

officialswitchmusic.com

thepretenseofjustice.com

Targets

    • Target

      f51da2ac8cdfc1ff41921f0fceee4514

    • Size

      440KB

    • MD5

      f51da2ac8cdfc1ff41921f0fceee4514

    • SHA1

      f910ed6637480ff6930df72d9258029641a186ba

    • SHA256

      f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175

    • SHA512

      830f6fadf25b3b839d648a71e82eb3fb37c0e5376d5ce76044a39321ab54f356cec4f9a8ef08f01ebe2d86b6e6643a24a591b680ab2f88c29ecb8e43e837ed46

    Score
    10/10
    xloadernohaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks