xloader

General

Target

cab6a894346113a86f76887b9bd68827d34f293212b1f62bbf96eec39192da3a
Size

335KB
Sample

241121-y23mxawqgy
MD5

faf3572485796ddc61f80587055e4454
SHA1

b74c1c90a2f76285db515fea71a1e093c59366da
SHA256

cab6a894346113a86f76887b9bd68827d34f293212b1f62bbf96eec39192da3a
SHA512

11ad1be429965b3a0be3b3d495b8ca1985f1aba461213e62f0118982442bd1bcbd3ce4f4249d816cd2d701fa82a40d0c9961292200a614ccb2b37eded4efb7f8
SSDEEP

6144:L0lEqHKJDYalDyT8IfSRP9z16sPCIKLYLRUQYYjELs/kNEE8CCR7J7MMIDRY7YJu:L0lEJJ0axyo/VHTmKRUiDEwR17MMwusU

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cda8

Decoy

ajiwechouf.com

chesterkturner.store

tanxiaoyouhongru.space

indiacbc.com

coricanteen.com

supports-teams.com

triandreas.com

fyonkaly.com

m-bald-lab.com

frankserranolaw.com

testedeployheroku.club

wasildelivery.com

stonebyparamount.com

mehmetmercan.com

digitalmarketingyou.com

luxuryrelocationrentals.com

xn--e1aqdnq.store

scw-group.com

onelovemarketingsolution.com

diygardenlife.com

Targets

- Target
  
  d86cf31f07e444277514916de369cb6b80e1a405a1ced387d04c1431b94461f5
- Size
  
  495KB
- MD5
  
  63e399da64bb8241bead7bb544e4adfd
- SHA1
  
  fae9215acf6375e84629cfa374dc2fcddac0f965
- SHA256
  
  d86cf31f07e444277514916de369cb6b80e1a405a1ced387d04c1431b94461f5
- SHA512
  
  2fb848f8e159e3c86d70008077e3717a594c79375c4fa652d7143685a33fda52236b9a8efff2a31e9e56c5e92a1feb5c66f8fbf0769d3296f501d3c250bc9270
- SSDEEP
  
  6144:C1qQRi7b6btLfjFnw70QSqdkVNIEwRcJN/dON6HegePEEo+M4/B:2qQRdrjJw70QYIEwANVm/sERMa
Score

10^/10

xloader cda8 discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2