Overview

overview

10

Static

static

GV8EJooYMIgEnEk.exe

windows7_x64

10

GV8EJooYMIgEnEk.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GV8EJooYMIgEnEk.exe

  • Size

    382KB

  • Sample

    220128-tgt3tagccm

  • MD5

    cf6d4fd3dc8e4751b7f89f857b618ef3

  • SHA1

    15b95f0f1b5785bb7fd3d97757f3eea49d1f6951

  • SHA256

    9689e8e0cf51b8b5c98ddb007636d8acf7e03c9cc8a7bf99aafdaaebae2dfb3a

  • SHA512

    86af327caf1d55c8d3dd1e2319dcae1faaf7db82fb2fdce83999b0a4e5c6af2ce700fb0c69f568169110f04b9af6543e069aee59101370d6af060d8d4763d43f

Score
10/10
xloadercbgoloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

tablescaperendezvous4two.net

abktransportllc.net

roseevision.com

skategrindingwheels.com

robux-generator-free.xyz

yacusi.com

mgav35.xyz

paravocecommerce.com

venkatramanrm.com

freakyhamster.com

jenaashoponline.com

dmozlisting.com

lorrainekclark.store

handyman-prime.com

thecrashingbrains.com

ukpms.com

livingstonemines.com

papeisonline.com

chrisbakerpr.com

omnipets.store

Targets

    • Target

      GV8EJooYMIgEnEk.exe

    • Size

      382KB

    • MD5

      cf6d4fd3dc8e4751b7f89f857b618ef3

    • SHA1

      15b95f0f1b5785bb7fd3d97757f3eea49d1f6951

    • SHA256

      9689e8e0cf51b8b5c98ddb007636d8acf7e03c9cc8a7bf99aafdaaebae2dfb3a

    • SHA512

      86af327caf1d55c8d3dd1e2319dcae1faaf7db82fb2fdce83999b0a4e5c6af2ce700fb0c69f568169110f04b9af6543e069aee59101370d6af060d8d4763d43f

    Score
    10/10
    xloadercbgoloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks