Overview

overview

10

Static

static

1

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    249KB

  • Sample

    220228-wr1dpagcdm

  • MD5

    d3b9370b3c3393d6e8fb33e21401821a

  • SHA1

    0bc68ad6255f079e9c47676c42ae788654e66b4c

  • SHA256

    aff750da4f60877f5207d6b9f741482e139f9bdfcc4986446ff340203a8aac02

  • SHA512

    2e92043f4d446daf67105603a8964bee1e8951000a4d7f3867f167b85975c7f9c13ae3a448cd97f1f5169c6f94289d23ccab7f6c9ea5b1a27c20c9ad808e45d3

Score
10/10
xloaderp2a5loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      tmp

    • Size

      249KB

    • MD5

      d3b9370b3c3393d6e8fb33e21401821a

    • SHA1

      0bc68ad6255f079e9c47676c42ae788654e66b4c

    • SHA256

      aff750da4f60877f5207d6b9f741482e139f9bdfcc4986446ff340203a8aac02

    • SHA512

      2e92043f4d446daf67105603a8964bee1e8951000a4d7f3867f167b85975c7f9c13ae3a448cd97f1f5169c6f94289d23ccab7f6c9ea5b1a27c20c9ad808e45d3

    Score
    10/10
    xloaderp2a5loaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks