xloader | d3a9a3edb7bf2c1c0bee319acb384b4ea0d27a72c09ee0781996ecc4b6637fef

Analysis

max time kernel
123s
max time network
145s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-10-2021 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d6732ff73403961d2b131ac1237393.exe
Size

328KB
MD5

05d6732ff73403961d2b131ac1237393
SHA1

6bbfde0a9600bc7b5a5fdb04b2fb308d683b338d
SHA256

d3a9a3edb7bf2c1c0bee319acb384b4ea0d27a72c09ee0781996ecc4b6637fef
SHA512

1041901d78cd8345e665f4e81fa40e486eb4a762e28216e85755a08818fea1b593fa0053bef3aaf55df317675a02b2ce1f4f53cdaefcd10d4bc038baf253af09

Score

10^/10

xloader bs8f loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

bs8f

http://www.rwilogisticsandbrokerage.com/bs8f/

Decoy

vasilnikov.com

parkate.club

pol360.com

handmadequatang.com

consult-set.com

nourkoki.com

theveganfusspot.com

dreamssail.com

pinpinyouqian.xyz

satellitphonestore.com

yotosunny.com

telosaolympics.com

gogetemm.com

yozotnpasumo2.xyz

avantgardemarket.com

glenndcp.com

dirtydriverz.com

avaui.com

anchoredtheblog.com

marianaoliveiraarquitetura.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/896-54-0x0000000002F20000-0x0000000002F49000-memory.dmp	xloader
behavioral1/memory/896-55-0x0000000000400000-0x0000000002F19000-memory.dmp	xloader

C:\Users\Admin\AppData\Local\Temp\05d6732ff73403961d2b131ac1237393.exe
"C:\Users\Admin\AppData\Local\Temp\05d6732ff73403961d2b131ac1237393.exe"
1⤵
PID:896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-53-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download
memory/896-54-0x0000000002F20000-0x0000000002F49000-memory.dmp

Filesize
164KB

Download
memory/896-55-0x0000000000400000-0x0000000002F19000-memory.dmp

Filesize
43.1MB

Download