Overview

overview

10

Static

static

SKM_0174562S.exe

windows7_x64

10

SKM_0174562S.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SKM_0174562S.exe

  • Size

    20KB

  • Sample

    220330-nt2ersbhb4

  • MD5

    58ca4ec15f6629c916a7348abe6653b8

  • SHA1

    94d3851c22822caad29a406c106c68fa5ddabcd8

  • SHA256

    6c70916e3e579d049190487f2415804c50bae69b409a1cffbc6de56e7976af80

  • SHA512

    9cdef2711f3726caba190e9bc90cb7c66c69ba420cf690b3a9caac8d48fbdf36e0ca315dba7bacfc91b5ace63ca75242046d8c5d243d9c22930438ec6bda15dd

Score
10/10
xloaderahc8loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Targets

    • Target

      SKM_0174562S.exe

    • Size

      20KB

    • MD5

      58ca4ec15f6629c916a7348abe6653b8

    • SHA1

      94d3851c22822caad29a406c106c68fa5ddabcd8

    • SHA256

      6c70916e3e579d049190487f2415804c50bae69b409a1cffbc6de56e7976af80

    • SHA512

      9cdef2711f3726caba190e9bc90cb7c66c69ba420cf690b3a9caac8d48fbdf36e0ca315dba7bacfc91b5ace63ca75242046d8c5d243d9c22930438ec6bda15dd

    Score
    10/10
    xloaderahc8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks