Overview

overview

10

Static

static

Halkbank_E...1).exe

windows7_x64

10

Halkbank_E...1).exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Halkbank_Ekstre_20220128_081138_756957 (1).exe

  • Size

    17KB

  • Sample

    220128-zr7pjsdge9

  • MD5

    749aaf49615aa07edc9755541b213a4a

  • SHA1

    8e856cae4e8d14c7d37f5d8342fc2d30acfede64

  • SHA256

    d47bd2ff5d90d64d18485203e59a952e485a39f98e3d54258a578b13d9136ae7

  • SHA512

    a3b731a35b418ab43efc8d09e2373bb659dc78fa8408fa6edc6da66d13e03f13228b6db22eab4a47be96a99c162c09d01565182e3684e61a0fa017e9c7b4f7b7

Score
10/10
xloaderpo6rloaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

po6r

Decoy

jnhuichuangxin.com

mubashir.art

extol.design

doyyindh.xyz

milanoautoexperts.com

4thefringe.com

453511.com

sellathonautocredit.com

velgian.com

6672pk.com

wodeluzhou.com

sumiyoshiku-hizaita.xyz

imoveldeprimeira.com

dgjssp.com

endokc.com

side-clicks.com

cashndashfinancial.com

vanhemelryck.info

agamitrading.com

woofgang.xyz

Targets

    • Target

      Halkbank_Ekstre_20220128_081138_756957 (1).exe

    • Size

      17KB

    • MD5

      749aaf49615aa07edc9755541b213a4a

    • SHA1

      8e856cae4e8d14c7d37f5d8342fc2d30acfede64

    • SHA256

      d47bd2ff5d90d64d18485203e59a952e485a39f98e3d54258a578b13d9136ae7

    • SHA512

      a3b731a35b418ab43efc8d09e2373bb659dc78fa8408fa6edc6da66d13e03f13228b6db22eab4a47be96a99c162c09d01565182e3684e61a0fa017e9c7b4f7b7

    Score
    10/10
    xloaderpo6rloaderpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks