Overview

overview

10

Static

static

1

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    330KB

  • Sample

    220307-np187sdhh4

  • MD5

    1aed40a6d6905d5925b73ed69e2abe5c

  • SHA1

    9db9a82acad118dc6982aebbeafad0da4275761c

  • SHA256

    2420028d36da51aa0dae20755b04a555fd1fb943900b92694dd07b98a240fcf8

  • SHA512

    d081ffea933add3fc01fa413503a28c4b7ecbcabff7adecaa7be2b827de87b116e9b7c5d30c402a2a70a3bdd42590c604ff8c179f2135df71c461aad2618c65e

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      tmp

    • Size

      330KB

    • MD5

      1aed40a6d6905d5925b73ed69e2abe5c

    • SHA1

      9db9a82acad118dc6982aebbeafad0da4275761c

    • SHA256

      2420028d36da51aa0dae20755b04a555fd1fb943900b92694dd07b98a240fcf8

    • SHA512

      d081ffea933add3fc01fa413503a28c4b7ecbcabff7adecaa7be2b827de87b116e9b7c5d30c402a2a70a3bdd42590c604ff8c179f2135df71c461aad2618c65e

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks