Overview

overview

10

Static

static

sample cat...22.exe

windows7_x64

10

sample cat...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample catalog 2022.exe

  • Size

    379KB

  • Sample

    220708-p2xxzscfbr

  • MD5

    7b5078b51f6d1f9daec3e4113bdc4f17

  • SHA1

    45330b3ae78f978305cd29a4c546ef561390e4e1

  • SHA256

    be5b336a3ad03b3b70a286e38ba35c631f7d98f3c54e996c2e787f225b449879

  • SHA512

    b6003603b3676fe36ae809c873a1a766f52eb6cfab88ddc151ef8d2b64139e34e13c0b1d4f2b90181f71d6b4f2151dfc523000d0585aa9433d8581d6e27cf582

Score
10/10
xloadervweqloaderratspywarestealersuricata

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

vweq

Decoy

malang-media.com

mrsfence.com

lubetops.com

aitimedia.net

montecryptocapital.com

ahwmedia.com

bvmnc.site

bggearstore.com

bcsantacoloma.online

alltimephotography.com

santacruz-roofings.com

leaplifestyleenterprises.com

censovet.com

similkameenfarms.com

undisclosed.email

thetrinityco.com

rapiturs.com

jedlersdorf.info

mh7jk12e.xyz

flygurlblogwordpress.com

Targets

    • Target

      sample catalog 2022.exe

    • Size

      379KB

    • MD5

      7b5078b51f6d1f9daec3e4113bdc4f17

    • SHA1

      45330b3ae78f978305cd29a4c546ef561390e4e1

    • SHA256

      be5b336a3ad03b3b70a286e38ba35c631f7d98f3c54e996c2e787f225b449879

    • SHA512

      b6003603b3676fe36ae809c873a1a766f52eb6cfab88ddc151ef8d2b64139e34e13c0b1d4f2b90181f71d6b4f2151dfc523000d0585aa9433d8581d6e27cf582

    Score
    10/10
    xloadervweqloaderratspywarestealersuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader payload

      rat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks