Overview

overview

10

Static

static

1

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

  • Size

    292KB

  • Sample

    220217-m3pa5abaa9

  • MD5

    be6ece1b6510c986870d8ceabb87988b

  • SHA1

    63795ce8b9c7fd5ec3374e3e012b3898a8695f53

  • SHA256

    b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

  • SHA512

    c7296be4cf5c14ada776312ceeedd29b52b6e4e228e6f1453e5485571099f6c517e90c6f33b88835b51130056bca6d2401d1bd6aed7e0b9d590d3b7b2c60a334

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

    • Size

      292KB

    • MD5

      be6ece1b6510c986870d8ceabb87988b

    • SHA1

      63795ce8b9c7fd5ec3374e3e012b3898a8695f53

    • SHA256

      b7cf8d9d8db4c5eaf796d35251bfc2b24f34c2c77d2ca82a1ebf470323c0894f

    • SHA512

      c7296be4cf5c14ada776312ceeedd29b52b6e4e228e6f1453e5485571099f6c517e90c6f33b88835b51130056bca6d2401d1bd6aed7e0b9d590d3b7b2c60a334

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks