Overview

overview

10

Static

static

10

b4c024b530...7b.exe

windows7_x64

10

b4c024b530...7b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4c024b530685b4d6624a05969d9997b.exe

  • Size

    327KB

  • Sample

    211103-yce6baefd8

  • MD5

    b4c024b530685b4d6624a05969d9997b

  • SHA1

    a584891d70ea5cc84d7d2934f3ea70af83b83980

  • SHA256

    1b6ff162d06ef0d1df78ada89bc99374b76362c5693b625ef9d46c9ee50e5309

  • SHA512

    3c6db8b881da0e6b0ee4b4effea7f1130ec6fec5e603f8617e2365cc4816c837bbca3c38af61015f48d201a20b027d131adac5a2e3df45b71d801b8feee1c4eb

Score
10/10
neshtaxloaderqw2cloaderpersistenceratspywarestealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

qw2c

C2

http://www.qhatu-peru.com/qw2c/

Decoy

tripleincome.trade

theorigins.xyz

codzpays.com

tacocoparker.com

athensbyozanfirat.com

aero-charger.com

mobiushs.com

wealthpatternsllc.net

oneuplord.net

19kaldenbergplace.com

dxalt.com

pageants.xyz

mengyaoke.xyz

xn--80aaudhcmg4b.online

kpmg-grab.com

unsiontv.com

builderclubvn.com

shafara.com

bmwrepairnashville.com

gelgist.com

Targets

    • Target

      b4c024b530685b4d6624a05969d9997b.exe

    • Size

      327KB

    • MD5

      b4c024b530685b4d6624a05969d9997b

    • SHA1

      a584891d70ea5cc84d7d2934f3ea70af83b83980

    • SHA256

      1b6ff162d06ef0d1df78ada89bc99374b76362c5693b625ef9d46c9ee50e5309

    • SHA512

      3c6db8b881da0e6b0ee4b4effea7f1130ec6fec5e603f8617e2365cc4816c837bbca3c38af61015f48d201a20b027d131adac5a2e3df45b71d801b8feee1c4eb

    Score
    10/10
    neshtaxloaderqw2cloaderpersistenceratspywarestealer

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks