Overview

overview

10

Static

static

1

INV8827272...72.exe

windows7_x64

10

INV8827272...72.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV88272727271_REQUIREMENT_02727272272.pif

  • Size

    245KB

  • Sample

    220126-wr3h2sggg2

  • MD5

    1a97ab72ef6c22d9508ad78db60ca205

  • SHA1

    05122e7544d6eaa53aaf36cc34aff27a17a192d7

  • SHA256

    947a0f977737ff7dfa8ae17eb2eff4b0ec4b51479c76f12f60d0b8c40ca9d323

  • SHA512

    cb541ef914b7c998913dfe0359a1b42345fc5705f174399c8153cab4e2a6c542d6881ef00d83505c6fbc3b38c1eddf033bc90ca67dcc3050f8d3264caa34ed36

Score
10/10
xloaderrmfgloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

rmfg

Decoy

prospectcompounding.com

grand-prix.voyage

solvingpklogc.xyz

eliamhome.com

gamevip88.club

arsels.info

dswlt.com

dchehe.com

lawyerjerusalem.com

pbnseo.xyz

apuryifuid.com

kiukiupoker88.net

leannonimpact.com

kare-furniture.com

mississaugaremax.online

zpyh198.com

dueplay.store

naimi.ltd

greenstepspodiatry.com

cewirtanen.com

Targets

    • Target

      INV88272727271_REQUIREMENT_02727272272.pif

    • Size

      245KB

    • MD5

      1a97ab72ef6c22d9508ad78db60ca205

    • SHA1

      05122e7544d6eaa53aaf36cc34aff27a17a192d7

    • SHA256

      947a0f977737ff7dfa8ae17eb2eff4b0ec4b51479c76f12f60d0b8c40ca9d323

    • SHA512

      cb541ef914b7c998913dfe0359a1b42345fc5705f174399c8153cab4e2a6c542d6881ef00d83505c6fbc3b38c1eddf033bc90ca67dcc3050f8d3264caa34ed36

    Score
    10/10
    xloaderrmfgloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks