xloader | a867838e4c814a302323d06d5be15caf2629a8ad7cfeea2f9ba9b09cd8edcd89 | Triage

Sharing

General

Target

a867838e4c814a302323d06d5be15caf2629a8ad7cfeea2f9ba9b09cd8edcd89
Size

252KB
Sample

211019-ef13eafbg4
MD5

6d67846f8c9cd695f6ee85e70bd44156
SHA1

0989a490fceef1fcf520c982eb936bf36d200453
SHA256

a867838e4c814a302323d06d5be15caf2629a8ad7cfeea2f9ba9b09cd8edcd89
SHA512

9bb925e305b2f92782cecd56261436ead15f73feea0a9a684b919ac9531e376b3d5346207a7f2a9a712007f6fa0812d4dada8f9c9994d27821a09b3864b791f2

Score

10^/10

xloader mxnu loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

- Target
  
  a867838e4c814a302323d06d5be15caf2629a8ad7cfeea2f9ba9b09cd8edcd89
- Size
  
  252KB
- MD5
  
  6d67846f8c9cd695f6ee85e70bd44156
- SHA1
  
  0989a490fceef1fcf520c982eb936bf36d200453
- SHA256
  
  a867838e4c814a302323d06d5be15caf2629a8ad7cfeea2f9ba9b09cd8edcd89
- SHA512
  
  9bb925e305b2f92782cecd56261436ead15f73feea0a9a684b919ac9531e376b3d5346207a7f2a9a712007f6fa0812d4dada8f9c9994d27821a09b3864b791f2
Score

10^/10

xloader mxnu loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xloadermxnuloaderrat