Overview

overview

10

Static

static

1

dekont.exe

windows7_x64

8

dekont.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dekont.exe

  • Size

    269KB

  • Sample

    220414-ggxgqaggf8

  • MD5

    1218da9d299571a80c774838d2a55516

  • SHA1

    1bce59e7afb303e0c170cb8f6fdb5a1806e41eda

  • SHA256

    50a9cc4decaf32975996710740956b5a9c4985c50ded5a2bb8611945263af65a

  • SHA512

    96fef1449441f526e05a1c514d4cb464bbaa2156e8c2e1c84563ac8eb22ee132c2e3593bd09e0516ba171879b4c52d71ddf064abb9dc2a7c1e23f54ecb930895

Score
10/10
xloadercbgoloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

santesha.com

britneysbeautybar.com

sh-cy17.com

jeffcarveragency.com

3117111.com

sobrehosting.net

ddm123.xyz

toxcompliance.com

auditorydesigns.com

vliftfacial.com

ielhii.com

naameliss.com

ritualchariot.com

solchange.com

quatre-vingts.design

lawnmowermashine.com

braceletsstore.net

admappy.com

tollivercoltd.com

vaidix.com

Targets

    • Target

      dekont.exe

    • Size

      269KB

    • MD5

      1218da9d299571a80c774838d2a55516

    • SHA1

      1bce59e7afb303e0c170cb8f6fdb5a1806e41eda

    • SHA256

      50a9cc4decaf32975996710740956b5a9c4985c50ded5a2bb8611945263af65a

    • SHA512

      96fef1449441f526e05a1c514d4cb464bbaa2156e8c2e1c84563ac8eb22ee132c2e3593bd09e0516ba171879b4c52d71ddf064abb9dc2a7c1e23f54ecb930895

    Score
    10/10
    xloadercbgoloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks