Overview

overview

10

Static

static

1

SCAN_11287...pg.exe

windows7_x64

10

SCAN_11287...pg.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCAN_112877484993940484_jpg.exe

  • Size

    364KB

  • Sample

    220309-g8cavshbgj

  • MD5

    344bbe5e0e86adb47e54e3b87601bf2a

  • SHA1

    f350ac874315f23a45605e389b3848dd70c00c46

  • SHA256

    a37ef7dac182a6cea6afeb46e114c8ff98a4befa00a3ee353885a354c9d58109

  • SHA512

    468b7a371b05b8489ca1d915707ebdc54625231feb8a7f4bb3aaa293811837e8c805c789799aa3a28919b5daa40dc2b4ec4eb23c8a8a957374556c954d483334

Score
10/10
xloaderubqkloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ubqk

Decoy

tundrat-celltherapy.com

superfinance.club

5x5week.com

687504.com

clarkdn.com

potterypklsck.xyz

4m5k.com

21t8.com

94o2ohfjg.com

bhupendratravels.com

nomadashop.com

w388bet.bet

naturalenetwork.net

tupaqu.com

osooir.com

jengly.com

cbsharjah.icu

tokowallpaperbekasi.com

baggamut.com

upoon81.com

Targets

    • Target

      SCAN_112877484993940484_jpg.exe

    • Size

      364KB

    • MD5

      344bbe5e0e86adb47e54e3b87601bf2a

    • SHA1

      f350ac874315f23a45605e389b3848dd70c00c46

    • SHA256

      a37ef7dac182a6cea6afeb46e114c8ff98a4befa00a3ee353885a354c9d58109

    • SHA512

      468b7a371b05b8489ca1d915707ebdc54625231feb8a7f4bb3aaa293811837e8c805c789799aa3a28919b5daa40dc2b4ec4eb23c8a8a957374556c954d483334

    Score
    10/10
    xloaderubqkloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks