Overview

overview

10

Static

static

1

FREIGHT US...89.exe

windows7_x64

10

FREIGHT US...89.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FREIGHT USD INV#1191189.exe

  • Size

    438KB

  • Sample

    211117-sf7f3sdah9

  • MD5

    9c44290565c5229c831a9b92b4b9157e

  • SHA1

    ed279316bda9fb14ef83cb7e3e24431ed5c13913

  • SHA256

    86ee2da84c77bdb3332ae0614c2d5ddb3a9f9696cd82bb805b104ac4dd4302fb

  • SHA512

    1447845e3398e79a12c7fe0272e9826a97d895f1544a133fbea5efa923c8fb5eb046cc2a04f74f0b6b922abdca0f9d154d15994a60a4dfa3ef9398fc08a4fa3b

Score
10/10
xloaderea0rloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Targets

    • Target

      FREIGHT USD INV#1191189.exe

    • Size

      438KB

    • MD5

      9c44290565c5229c831a9b92b4b9157e

    • SHA1

      ed279316bda9fb14ef83cb7e3e24431ed5c13913

    • SHA256

      86ee2da84c77bdb3332ae0614c2d5ddb3a9f9696cd82bb805b104ac4dd4302fb

    • SHA512

      1447845e3398e79a12c7fe0272e9826a97d895f1544a133fbea5efa923c8fb5eb046cc2a04f74f0b6b922abdca0f9d154d15994a60a4dfa3ef9398fc08a4fa3b

    Score
    10/10
    xloaderea0rloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks