xloader | 6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4 | Triage

Sharing

General

Target

6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4
Size

255KB
Sample

211019-gvg9ysgbgp
MD5

222edb446ae73e059a6d50d07741f24c
SHA1

fb2c10180167c27b6a92d877a3ca722a97a94a72
SHA256

6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4
SHA512

f259ff40b25b5702ee00144a52c8a4835de071311b86fb15becfd7a814246438d550734cb283286f5efec476c8f1f4b4a3a6d7772dcfefe2cce4ae12a9c27ebe

Score

10^/10

xloader mxnu loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Targets

- Target
  
  6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4
- Size
  
  255KB
- MD5
  
  222edb446ae73e059a6d50d07741f24c
- SHA1
  
  fb2c10180167c27b6a92d877a3ca722a97a94a72
- SHA256
  
  6f647afcbbfcefe1f393f978a3c684bce3da2ac4b2c9d3723f3c8de8a75edae4
- SHA512
  
  f259ff40b25b5702ee00144a52c8a4835de071311b86fb15becfd7a814246438d550734cb283286f5efec476c8f1f4b4a3a6d7772dcfefe2cce4ae12a9c27ebe
Score

10^/10

xloader mxnu loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xloadermxnuloaderrat