xloader

General

Target

5d10c77689e0c3bea850fa3c9ef40e8c
Size

516KB
Sample

211206-n2wjgsdhgq
MD5

5d10c77689e0c3bea850fa3c9ef40e8c
SHA1

35dca95d10a31fe0b1832f43005c0a79a6854604
SHA256

8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d
SHA512

920b5f4c55db41e225bb760a2d26b4aec8fed0d3d66392bbe8acf91cec35097e0934a2559661dd45eaa5b2303c102eedb4c88aef91e024c05b78d6cf289f795a

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Targets

- Target
  
  5d10c77689e0c3bea850fa3c9ef40e8c
- Size
  
  516KB
- MD5
  
  5d10c77689e0c3bea850fa3c9ef40e8c
- SHA1
  
  35dca95d10a31fe0b1832f43005c0a79a6854604
- SHA256
  
  8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d
- SHA512
  
  920b5f4c55db41e225bb760a2d26b4aec8fed0d3d66392bbe8acf91cec35097e0934a2559661dd45eaa5b2303c102eedb4c88aef91e024c05b78d6cf289f795a
Score

10^/10

xloader ea0r loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2