Overview

overview

10

Static

static

Product_Or...22.exe

windows7_x64

10

Product_Or...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Product_Order#250422.exe

  • Size

    257KB

  • Sample

    220426-gcv34afcak

  • MD5

    265de87c891fc42f378339b4ce0406f5

  • SHA1

    76dee4e7e7c2f22da904b6629880c3f89dca8fed

  • SHA256

    2affbb57b10032083dc1fe15a3c1ff1a2aa0b59f74b4ac6d094e94db6a650faa

  • SHA512

    ca3e0a56c00928958f406ea5841b8c3f21076cd57e31c1818f8801addb7d0436aaf75bc3ae75f0a859fd7601b8dd8569ee658892bff00124324bc76b1a327f4f

Score
10/10
xloaderdx3nloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dx3n

Decoy

polebear.xyz

luciamoca.com

185451.com

bookfriendspodcast.net

reliancetechsolutions.com

wuzuiso.com

ig-representative.com

ryotaohno.com

wlnhcl.com

oasispoolth.com

fo71.com

storyandidentity.com

sayarpro.com

arrow-electronics-corps.net

brasbux.com

nigeriaafricasummit.com

choud.store

medicareopenenrollment.info

amlhcz.com

fdklflkdioerklfdke.store

Targets

    • Target

      Product_Order#250422.exe

    • Size

      257KB

    • MD5

      265de87c891fc42f378339b4ce0406f5

    • SHA1

      76dee4e7e7c2f22da904b6629880c3f89dca8fed

    • SHA256

      2affbb57b10032083dc1fe15a3c1ff1a2aa0b59f74b4ac6d094e94db6a650faa

    • SHA512

      ca3e0a56c00928958f406ea5841b8c3f21076cd57e31c1818f8801addb7d0436aaf75bc3ae75f0a859fd7601b8dd8569ee658892bff00124324bc76b1a327f4f

    Score
    10/10
    xloaderdx3nloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks