Overview

overview

10

Static

static

Purchase O...43.exe

windows7_x64

10

Purchase O...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order FEB22_76543.exe

  • Size

    600KB

  • Sample

    220218-hlctjsbhc2

  • MD5

    939ab865c8b7be3fdfaf765139a62f02

  • SHA1

    fbe936019b2596e65ff25cb46abdb0f48fa93464

  • SHA256

    c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7

  • SHA512

    cf170932a7a1f57ea6e8e708bb28ec5c2487a40215b777a9cf6f653ebf3d75f32e95d00991de25d013fc3c7faa8ce5b13fbdbaeb12b8e752d808107e7695f763

Score
10/10
xloaderzqzwloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Targets

    • Target

      Purchase Order FEB22_76543.exe

    • Size

      600KB

    • MD5

      939ab865c8b7be3fdfaf765139a62f02

    • SHA1

      fbe936019b2596e65ff25cb46abdb0f48fa93464

    • SHA256

      c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7

    • SHA512

      cf170932a7a1f57ea6e8e708bb28ec5c2487a40215b777a9cf6f653ebf3d75f32e95d00991de25d013fc3c7faa8ce5b13fbdbaeb12b8e752d808107e7695f763

    Score
    10/10
    xloaderzqzwloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks