Overview

overview

10

Static

static

1

Enquiry files1_3.exe

windows7_x64

10

Enquiry files1_3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Enquiry files1_3.exe

  • Size

    249KB

  • Sample

    211022-cazlaabad3

  • MD5

    ef243115db5fd87673b93a350bfc68f4

  • SHA1

    533fcc44583bb2f952cd76e7eeac1cab65de915f

  • SHA256

    408d42bbe82ea5d8abee447060a40ff8289f4c3317022d6c0a1081c37d25b164

  • SHA512

    90d5a174fabc57e74e78ec36c9ffd46c2db9ede8018ef29238017e5d5c87ae81813f68a42deb8dce891b25320f143bb47b01cefbc55f529499337a430de06f17

Score
10/10
xloaderga6bloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ga6b

C2

http://www.egyptian-museum.com/ga6b/

Decoy

diasporacospices.com

sd-shenghe.com

onlinewritingjobs.net

greenstreamgroup.store

garageair.agency

idh-bf.com

middenhavendambreskens.com

szkoleniawcag.online

wiremefeelings.com

ottosperformance.com

brothermush.com

weiserpath.com

baohiemtv24h.com

glassgalaxynft.com

spiritualmind.space

18130072012.com

3v0.space

smartgadgetscompare.com

corvusexpeditii.xyz

egcontabilidade.website

Targets

    • Target

      Enquiry files1_3.exe

    • Size

      249KB

    • MD5

      ef243115db5fd87673b93a350bfc68f4

    • SHA1

      533fcc44583bb2f952cd76e7eeac1cab65de915f

    • SHA256

      408d42bbe82ea5d8abee447060a40ff8289f4c3317022d6c0a1081c37d25b164

    • SHA512

      90d5a174fabc57e74e78ec36c9ffd46c2db9ede8018ef29238017e5d5c87ae81813f68a42deb8dce891b25320f143bb47b01cefbc55f529499337a430de06f17

    Score
    10/10
    xloaderga6bloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks