Overview

overview

10

Static

static

1

Swift Copy_44000.exe

windows7_x64

10

Swift Copy_44000.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swift Copy_44000.exe

  • Size

    320KB

  • Sample

    211203-pb2s9agdhk

  • MD5

    03d853072e1cab50b55cce6883e5e72e

  • SHA1

    a3d35ebdb90c950db690d900c57b804cb4874b4e

  • SHA256

    5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c

  • SHA512

    0229de62952ebc975333eb6ec25e9d47fd7f658e44661d198d17a8b6b833291b42f4f08e7ec41e574dd2dba8d58da54c0c0375e1d764bd26fe84fc3aa70d8116

Score
10/10
xloadere8ialoaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Targets

    • Target

      Swift Copy_44000.exe

    • Size

      320KB

    • MD5

      03d853072e1cab50b55cce6883e5e72e

    • SHA1

      a3d35ebdb90c950db690d900c57b804cb4874b4e

    • SHA256

      5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c

    • SHA512

      0229de62952ebc975333eb6ec25e9d47fd7f658e44661d198d17a8b6b833291b42f4f08e7ec41e574dd2dba8d58da54c0c0375e1d764bd26fe84fc3aa70d8116

    Score
    10/10
    xloadere8ialoaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks