Overview

overview

10

Static

static

1

payment.exe

windows7_x64

7

payment.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment.exe

  • Size

    301KB

  • Sample

    211105-p6cslshabm

  • MD5

    c662f5f92a309035df41c2fa8ceec901

  • SHA1

    2555dbb5bf478e472d834d7fee163fa75598eabf

  • SHA256

    43205d5f8958ebc397086aa525220e381f4b0da942f071f236bdbe21280fe1b8

  • SHA512

    8984f03fc2e0849c7e7ade5112158a6375d1b148beeddf35569410f56b1efa92796cac9ec6e94f0e71198fadf6b44cf3e3785eeb75cbd5483d1138d6ed9bc7ff

Score
10/10
xloaderunznloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

unzn

C2

http://www.davanamays.com/unzn/

Decoy

xiulf.com

highcountrymortar.com

523561.com

marketingagency.tools

ganmovie.net

nationaalcontactpunt.com

sirrbter.com

begizas.xyz

missimi-fashion.com

munixc.info

daas.support

spaceworbc.com

faithtruthresolve.com

gymkub.com

thegrayverse.xyz

artisanmakefurniture.com

029tryy.com

ijuubx.biz

iphone13promax.club

techuniversus.com

Targets

    • Target

      payment.exe

    • Size

      301KB

    • MD5

      c662f5f92a309035df41c2fa8ceec901

    • SHA1

      2555dbb5bf478e472d834d7fee163fa75598eabf

    • SHA256

      43205d5f8958ebc397086aa525220e381f4b0da942f071f236bdbe21280fe1b8

    • SHA512

      8984f03fc2e0849c7e7ade5112158a6375d1b148beeddf35569410f56b1efa92796cac9ec6e94f0e71198fadf6b44cf3e3785eeb75cbd5483d1138d6ed9bc7ff

    Score
    10/10
    xloaderunznloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks