Overview

overview

10

Static

static

1

ORDER N. 1487.exe

windows7_x64

10

ORDER N. 1487.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER N. 1487.exe

  • Size

    334KB

  • Sample

    211022-l4hz3abdh8

  • MD5

    08ae4dd275718d077172abb99be15464

  • SHA1

    cf99068f0ea4acafc515fbe334a71e62401ac757

  • SHA256

    7716fec715a46b0eb4518d53703b0fc2186e6a473a876de7aee9155ec289f93a

  • SHA512

    6fca40792388c3047701dd1a24854b420aaba8fb194dee35b58cecdaf57a65f6f843b77fe4ce1d89aee8cfd553d516afd76cefbc1b96349d3890015f191d1d42

Score
10/10
xloaderu3jaloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u3ja

C2

http://www.global-shopings.com/u3ja/

Decoy

emiratescomm.net

whattodotenerife.com

bspq-jlcd.com

torobesttanker.info

projectcentered.com

agglog.com

francesbypoppy.com

lakenormanpilates.net

chaseatms.com

bendarlingart.com

blogjust.xyz

wodeluzhou.com

p6ynwcxrxetb.biz

servpix.com

eddysearthmoving.com

rvafootcarenurses.com

contessa.store

jasonconcerttickets.com

umldbe.xyz

noroesteremotos.online

Targets

    • Target

      ORDER N. 1487.exe

    • Size

      334KB

    • MD5

      08ae4dd275718d077172abb99be15464

    • SHA1

      cf99068f0ea4acafc515fbe334a71e62401ac757

    • SHA256

      7716fec715a46b0eb4518d53703b0fc2186e6a473a876de7aee9155ec289f93a

    • SHA512

      6fca40792388c3047701dd1a24854b420aaba8fb194dee35b58cecdaf57a65f6f843b77fe4ce1d89aee8cfd553d516afd76cefbc1b96349d3890015f191d1d42

    Score
    10/10
    xloaderu3jaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks