Overview

overview

10

Static

static

3

7a9cf63d76...e3.exe

windows7-x64

10

7a9cf63d76...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a9cf63d76a9013b241c538061e457e3

  • Size

    603KB

  • Sample

    240127-syvj8sgfgl

  • MD5

    7a9cf63d76a9013b241c538061e457e3

  • SHA1

    f694dec9c2b83cb06887d7996031e69b748af9eb

  • SHA256

    28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83

  • SHA512

    822424d5ddd757cfc07b4cc99f8500f2f37884bb594e89b96bab63b6ada87c9105e8dfc500973b2c3c02354642d647a6d3be14b5fd1033ec1f513fed3ec16b02

  • SSDEEP

    12288:DE4qEJBJnO/F1l1+51DvL9YG3Gp0uyGwYvVPwD3GJDPdvaVMA:FJnO/3L+5RJypDm2JdvaeA

Score
10/10
xloadern58iloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n58i

Decoy

nl-cafe.com

votetedjaleta.com

britrobertsrealtor.com

globipark.com

citysucces.com

verisignwebsite-verified.com

riddlepc.com

rosecityclimbing.com

oleandrinextract.com

salmankonstruksi.com

needhamchannel.com

refreshx2z.com

youth66.com

pla-russia.com

halloweenmaskpro.com

exdysis.com

1gcz.com

lookgoodman.com

rlxagva.com

stlcityc.com

Targets

    • Target

      7a9cf63d76a9013b241c538061e457e3

    • Size

      603KB

    • MD5

      7a9cf63d76a9013b241c538061e457e3

    • SHA1

      f694dec9c2b83cb06887d7996031e69b748af9eb

    • SHA256

      28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83

    • SHA512

      822424d5ddd757cfc07b4cc99f8500f2f37884bb594e89b96bab63b6ada87c9105e8dfc500973b2c3c02354642d647a6d3be14b5fd1033ec1f513fed3ec16b02

    • SSDEEP

      12288:DE4qEJBJnO/F1l1+51DvL9YG3Gp0uyGwYvVPwD3GJDPdvaVMA:FJnO/3L+5RJypDm2JdvaeA

    Score
    10/10
    xloadern58iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks