Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c

  • Size

    1.1MB

  • Sample

    220125-m17dxsedgq

  • MD5

    e28fd2c13a6bc4dbc7b7836fcb1b224e

  • SHA1

    0b68827fbf894303055c9565abdeb85c5fa08b4d

  • SHA256

    d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c

  • SHA512

    1b407de96390a32a8a050265fc47e1289d16c89f08cac0eb116f7fd3ba6a8644c1b80cd4a50fd14a66dcfc9fedbda3ed2c54969f94272b3d7963c4e3f2f36022

Score
10/10
xloaderpnugloaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Targets

    • Target

      d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c

    • Size

      1.1MB

    • MD5

      e28fd2c13a6bc4dbc7b7836fcb1b224e

    • SHA1

      0b68827fbf894303055c9565abdeb85c5fa08b4d

    • SHA256

      d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c

    • SHA512

      1b407de96390a32a8a050265fc47e1289d16c89f08cac0eb116f7fd3ba6a8644c1b80cd4a50fd14a66dcfc9fedbda3ed2c54969f94272b3d7963c4e3f2f36022

    Score
    10/10
    xloaderpnugloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Sets service image path in registry

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks