Overview

overview

10

Static

static

1

b610b5c669...10.exe

windows7_x64

10

b610b5c669...10.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b610b5c669611fbb55ed5965a8cd0c10.exe

  • Size

    252KB

  • Sample

    211014-w27kraabb9

  • MD5

    b610b5c669611fbb55ed5965a8cd0c10

  • SHA1

    ecd743dc78d7aedaf33ffe0ddb8a6f242cb28b87

  • SHA256

    062a33046cca90bc6364cc29ccd47ae7f4165d388f5fb699bb88c35c4509bb90

  • SHA512

    33a51739fb7daed438c380fa54a9f8a39d80fffd5da709fab6bd2ccadc156c03a349bda89c4ee2677d4a1cf1fc2b7428be6cc005188b9d2305f7205020c220c3

Score
10/10
xloadermxnuloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

    • Target

      b610b5c669611fbb55ed5965a8cd0c10.exe

    • Size

      252KB

    • MD5

      b610b5c669611fbb55ed5965a8cd0c10

    • SHA1

      ecd743dc78d7aedaf33ffe0ddb8a6f242cb28b87

    • SHA256

      062a33046cca90bc6364cc29ccd47ae7f4165d388f5fb699bb88c35c4509bb90

    • SHA512

      33a51739fb7daed438c380fa54a9f8a39d80fffd5da709fab6bd2ccadc156c03a349bda89c4ee2677d4a1cf1fc2b7428be6cc005188b9d2305f7205020c220c3

    Score
    10/10
    xloadermxnuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks