Overview

overview

10

Static

static

3

20210812GLL_pdf.exe

windows7-x64

10

20210812GLL_pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0867481d77cd5a01f6701d1c5828158d

  • Size

    591KB

  • Sample

    231230-an5y4saff6

  • MD5

    0867481d77cd5a01f6701d1c5828158d

  • SHA1

    e78132a6e82206f7ff24421cfadf2c79e32c966d

  • SHA256

    54cc7072959884cba2b018d91925f5e120e8051f67bf4be8ee0545d9250d5be8

  • SHA512

    cffbe9470d870390872557b9f14971971be12a81cc577abc49761b0ae11057a50193e5e8cae37fcfe1876d767cb521d3c5ef90d7412dacb98772a8c7dde3821c

  • SSDEEP

    12288:t57fcABE1sKlP+X9CoFF+k9wQgqBGehRNyOKWSsETqxBAxXniR:DER1TsNxFFBOQTBZ6TqxMXiR

Score
10/10
xloaderzrmtloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

zrmt

Decoy

wesmerecountryclub.com

wisdomlenstransmedia.info

ostethy.com

zhclgm.com

rafiten.com

miteccloud.com

collagen6.com

94chuyu.com

coffeeandsupplycompany.com

siestone.com

salonandspaexperts.com

irnefzo.info

playback-theatre.com

ecomportableph.com

parkplatinum.com

1963tc.com

zaubers.com

getfitnesssupplement.com

lossolesmarketing.com

blueprintartco.com

Targets

    • Target

      20210812GLL_pdf.exe

    • Size

      930KB

    • MD5

      bd09ff330b19bc063abc8ce062c6d3c8

    • SHA1

      c8e0dd09234c3de91b12e093d6c3692a53b1f994

    • SHA256

      83e6f0e3b6342a02af22e36af1c9bfeb72fe90c6139e7c3894d557056f88ed05

    • SHA512

      cb78cae1e4d642fd21d450f0368f0f63cc9fd6383690c8262613abeeb6a77b973cd5a63bfe5b2b35671999cda66c6bb1f0dd0a4f200c45753fde4120e7482b0a

    • SSDEEP

      12288:7l/lDc9F3nC0Py3gAhhEJbjJEK3TTVc2Fkl+LHei7M97GLaZCTi56FZkqCcaM9UJ:aTTVc2iC+ilWki56FZE0UP6BzR5E

    Score
    10/10
    xloaderzrmtloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks