xloader

General

Target

SecuriteInfo.com.MSIL.TrojanDownloader.Agent.KBO.23714.19916
Size

78KB
Sample

220125-fk9qsahab5
MD5

81c4e8651ea490441f63ef7e795e1f70
SHA1

7b53c0c0b565a78d77350a7698481ba72ae59649
SHA256

40c96d51be2ae8a3360f39a25e522304df5999e05d99eeeeffb79fdc8fbbfd62
SHA512

97ec96e28f1059f80841db8af650987105fb3dabe3645a3c5857eae242c7a6fcb408e16484c82efe4fefc820cdac3d1661546bf583732ac11850c6c934a700a8

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

be4o

Decoy

neonewway.club

kuanghong.club

7bkj.com

ooo-club.com

kamchatka-agency.com

sjsndtvitzru.mobi

noireimpactcollective.net

justbe-event.com

easypeasy.community

southcoast.glass

janhenningsen.com

jmxyjj.com

tarihibilet.com

nagradi7.com

percentrostered.net

certvaxid.com

kingseafoodsydney.com

blacksheepwalk.com

waktuk.com

inteligenciaenrefrigeracion.com

Targets

- Target
  
  SecuriteInfo.com.MSIL.TrojanDownloader.Agent.KBO.23714.19916
- Size
  
  78KB
- MD5
  
  81c4e8651ea490441f63ef7e795e1f70
- SHA1
  
  7b53c0c0b565a78d77350a7698481ba72ae59649
- SHA256
  
  40c96d51be2ae8a3360f39a25e522304df5999e05d99eeeeffb79fdc8fbbfd62
- SHA512
  
  97ec96e28f1059f80841db8af650987105fb3dabe3645a3c5857eae242c7a6fcb408e16484c82efe4fefc820cdac3d1661546bf583732ac11850c6c934a700a8
Score

10^/10

xloader be4o loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2