Overview

overview

10

Static

static

5463f9d628...53.exe

windows7_x64

10

5463f9d628...53.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5463f9d6282814b6f0641c09d11c3b53.exe

  • Size

    55KB

  • Sample

    220129-kpbrrsgfdj

  • MD5

    5463f9d6282814b6f0641c09d11c3b53

  • SHA1

    e1021730d94fbd1c490b29601f6a1d43294832f7

  • SHA256

    ec6636f70ab0c5c4a752505049efb9e4ebb856671e6c47fe0c869b9efdf254d7

  • SHA512

    4e6fb2b43f7a170724a7cac291f6e5a97153f04235f97e9a034068921aadcc3fdfd45faa75b6885fa2890b261927a6be395bebdd7e6fe8a445e4b8cbb7815dc1

Score
10/10
xloaderssacloaderpersistencerat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ssac

Decoy

beautybybrin.com

oregemo.com

prospectoriq.com

blazermid.com

cloudnineloans.com

myyntisofta.com

filoupoils.com

web-solutiontnpasumo3.xyz

becbares.com

lines-hikkoshi.com

ohayouwww.com

writingdadsobituarywithdad.com

bridalbaes.com

jamshir.com

rangertots.com

dankbrobeans.com

titan111.com

uplearns.info

maxicashprokil.xyz

evc24.com

Targets

    • Target

      5463f9d6282814b6f0641c09d11c3b53.exe

    • Size

      55KB

    • MD5

      5463f9d6282814b6f0641c09d11c3b53

    • SHA1

      e1021730d94fbd1c490b29601f6a1d43294832f7

    • SHA256

      ec6636f70ab0c5c4a752505049efb9e4ebb856671e6c47fe0c869b9efdf254d7

    • SHA512

      4e6fb2b43f7a170724a7cac291f6e5a97153f04235f97e9a034068921aadcc3fdfd45faa75b6885fa2890b261927a6be395bebdd7e6fe8a445e4b8cbb7815dc1

    Score
    10/10
    xloaderssacloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks