Overview

overview

10

Static

static

10

5ecdf9607a...46.exe

windows7_x64

10

5ecdf9607a...46.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ecdf9607af624d3ec1ed2bc9f0e9146.exe

  • Size

    339KB

  • Sample

    211007-kyw43acdbp

  • MD5

    5ecdf9607af624d3ec1ed2bc9f0e9146

  • SHA1

    d68079d495932ef242efc76e96fe6d75a1ab8dc0

  • SHA256

    934615bde495d4cbbfd0178c6eea46804cb19a447db1a8781bb43c5986012cbb

  • SHA512

    b7fe77eb6f6fbd620a5a7d187d1355fb43ece505d46846703ea71e84205fb6511867756552202a5b95163cc651a5ab9a14cb1b0c13e50260a5c57993df39835c

Score
10/10
neshtaxloaderp08rloaderpersistenceratspywarestealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p08r

C2

http://www.puremicrodosing.com/p08r/

Decoy

focalstead.com

adult-affi2401.com

tamaracastrillejo.com

klimatika.pro

vineyardsimple.com

maskrgl.com

anamontenegro.website

lockolock.com

lkdgd.com

bgcs.online

tasteofgadsdencounty.com

abbastanza.info

serviciomovistar.online

xaudix.com

flintandfern.com

ranchoptician.com

tradeplay.net

chazuo.store

fb90km.com

americandropper.com

Targets

    • Target

      5ecdf9607af624d3ec1ed2bc9f0e9146.exe

    • Size

      339KB

    • MD5

      5ecdf9607af624d3ec1ed2bc9f0e9146

    • SHA1

      d68079d495932ef242efc76e96fe6d75a1ab8dc0

    • SHA256

      934615bde495d4cbbfd0178c6eea46804cb19a447db1a8781bb43c5986012cbb

    • SHA512

      b7fe77eb6f6fbd620a5a7d187d1355fb43ece505d46846703ea71e84205fb6511867756552202a5b95163cc651a5ab9a14cb1b0c13e50260a5c57993df39835c

    Score
    10/10
    neshtaxloaderp08rloaderpersistenceratspywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks