Overview

overview

10

Static

static

1

Originalgo...12.exe

windows7_x64

10

Originalgo...12.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Originalgoodsorder2022_196532012.exe

  • Size

    310KB

  • Sample

    220122-h13zaaacbn

  • MD5

    e1c16d90f07bc1d1540256db01ee6be1

  • SHA1

    0e3295b972ea3a2fb9f47e997f3aa694ece200bc

  • SHA256

    57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369

  • SHA512

    53b941e1348270d57d72bae84f0a23868e8e0b9c82a4d7209f62eb02b34ea14e9caf6da2171558f0d3464a4704eb9288a0bbbff4a62a90d9df74eaa59623f42b

Score
10/10
xloaderssacloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ssac

Decoy

beautybybrin.com

oregemo.com

prospectoriq.com

blazermid.com

cloudnineloans.com

myyntisofta.com

filoupoils.com

web-solutiontnpasumo3.xyz

becbares.com

lines-hikkoshi.com

ohayouwww.com

writingdadsobituarywithdad.com

bridalbaes.com

jamshir.com

rangertots.com

dankbrobeans.com

titan111.com

uplearns.info

maxicashprokil.xyz

evc24.com

Targets

    • Target

      Originalgoodsorder2022_196532012.exe

    • Size

      310KB

    • MD5

      e1c16d90f07bc1d1540256db01ee6be1

    • SHA1

      0e3295b972ea3a2fb9f47e997f3aa694ece200bc

    • SHA256

      57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369

    • SHA512

      53b941e1348270d57d72bae84f0a23868e8e0b9c82a4d7209f62eb02b34ea14e9caf6da2171558f0d3464a4704eb9288a0bbbff4a62a90d9df74eaa59623f42b

    Score
    10/10
    xloaderssacloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks