xloader

General

Target

8b7820fd7d45dcd564fb92db1ebe9295
Size

356KB
Sample

211202-l1nq5shed5
MD5

8b7820fd7d45dcd564fb92db1ebe9295
SHA1

c383a24a84143123f120f754bb0877b91628ff5b
SHA256

c1657f01ccef85f3f46740a96704bc5dccfb4cf8fc9ac09abcfd7aa6660448f7
SHA512

96ffc3d1d785035b47342b700d2930cf4daee597d02e97310a53be8baa819b403dbd96e82470fa0483f5bb442728c4e0eb352ebca0945070a49013451c441590

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Targets

- Target
  
  8b7820fd7d45dcd564fb92db1ebe9295
- Size
  
  356KB
- MD5
  
  8b7820fd7d45dcd564fb92db1ebe9295
- SHA1
  
  c383a24a84143123f120f754bb0877b91628ff5b
- SHA256
  
  c1657f01ccef85f3f46740a96704bc5dccfb4cf8fc9ac09abcfd7aa6660448f7
- SHA512
  
  96ffc3d1d785035b47342b700d2930cf4daee597d02e97310a53be8baa819b403dbd96e82470fa0483f5bb442728c4e0eb352ebca0945070a49013451c441590
Score

10^/10

xloader ea0r loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2