xloader | 098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04 | Triage

Sharing

General

Target

098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
Size

249KB
Sample

211014-e5xfhsfhhp
MD5

94dfabcfd1c2a9197ff2938cd52bad46
SHA1

8c7f75c3cf3d6a0c5bee876ee8b98045a186e154
SHA256

098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
SHA512

758bdc6b9f1dfb40c6b88ebac9a8fe7a09102172ae021af526f860e863a01f75e21cd4b332ae11a09b54cf67db900bbdd2bf9d5eeec7a9e6dab6798f6866c104

Score

10^/10

xloader mxnu loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

- Target
  
  098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
- Size
  
  249KB
- MD5
  
  94dfabcfd1c2a9197ff2938cd52bad46
- SHA1
  
  8c7f75c3cf3d6a0c5bee876ee8b98045a186e154
- SHA256
  
  098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
- SHA512
  
  758bdc6b9f1dfb40c6b88ebac9a8fe7a09102172ae021af526f860e863a01f75e21cd4b332ae11a09b54cf67db900bbdd2bf9d5eeec7a9e6dab6798f6866c104
Score

10^/10

xloader mxnu loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xloadermxnuloaderrat