Overview

overview

10

Static

static

1

TT COPY_02101011.exe

windows7_x64

10

TT COPY_02101011.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TT COPY_02101011.exe

  • Size

    302KB

  • Sample

    211125-vajh6sbbe9

  • MD5

    ebabc0d66a9e01cc0926f3b311feff5f

  • SHA1

    83a44664135a7255045becde754dae29be496c8f

  • SHA256

    ea8733d0ea6248e2f522487d09e7854230a648e67f1a5e90fea31f6305a1ff7b

  • SHA512

    b9f9c3ec7080bf31e0ab43b68f8183d75a59ae262e7320e846883f7ec91695e5e01d70432a163252712fc7bdb6e27b6e5fb6b5589e31eb8779f3b2b5586eeeeb

Score
10/10
xloadere8ialoaderpersistenceratspywarestealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Targets

    • Target

      TT COPY_02101011.exe

    • Size

      302KB

    • MD5

      ebabc0d66a9e01cc0926f3b311feff5f

    • SHA1

      83a44664135a7255045becde754dae29be496c8f

    • SHA256

      ea8733d0ea6248e2f522487d09e7854230a648e67f1a5e90fea31f6305a1ff7b

    • SHA512

      b9f9c3ec7080bf31e0ab43b68f8183d75a59ae262e7320e846883f7ec91695e5e01d70432a163252712fc7bdb6e27b6e5fb6b5589e31eb8779f3b2b5586eeeeb

    Score
    10/10
    xloadere8ialoaderratpersistencespywarestealer

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks