Overview

overview

10

Static

static

1

rfq.exe

windows7_x64

10

rfq.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rfq.exe

  • Size

    304KB

  • Sample

    211103-np1mnsdfd7

  • MD5

    1fefc11b33956003889da1a5337179f4

  • SHA1

    01a2773637fa5eea87508ee768d7ccff9bd09f7b

  • SHA256

    9b4f227304980351439c58e4b8a29844c7929c11de71051cf7c79f348996e8b1

  • SHA512

    f5e8faf8d630acf5a5f9cdd34e2b87cb67cb8877e5790ab63626adcb7f447bc05cd2d54b728b2c613f12b656c3a8f5b7516c0c5dcbed1a3d8bbcc1c0fa7c292a

Score
10/10
xloaderunznloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

unzn

C2

http://www.davanamays.com/unzn/

Decoy

xiulf.com

highcountrymortar.com

523561.com

marketingagency.tools

ganmovie.net

nationaalcontactpunt.com

sirrbter.com

begizas.xyz

missimi-fashion.com

munixc.info

daas.support

spaceworbc.com

faithtruthresolve.com

gymkub.com

thegrayverse.xyz

artisanmakefurniture.com

029tryy.com

ijuubx.biz

iphone13promax.club

techuniversus.com

Targets

    • Target

      rfq.exe

    • Size

      304KB

    • MD5

      1fefc11b33956003889da1a5337179f4

    • SHA1

      01a2773637fa5eea87508ee768d7ccff9bd09f7b

    • SHA256

      9b4f227304980351439c58e4b8a29844c7929c11de71051cf7c79f348996e8b1

    • SHA512

      f5e8faf8d630acf5a5f9cdd34e2b87cb67cb8877e5790ab63626adcb7f447bc05cd2d54b728b2c613f12b656c3a8f5b7516c0c5dcbed1a3d8bbcc1c0fa7c292a

    Score
    10/10
    xloaderunznloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks