xloader

General

Target

436ad6516dcb3802e9e18ea7a039a86f56ee3fdd18bec695222beb6ad625fd75
Size

365KB
Sample

241121-ypxacszqeq
MD5

40d916f47abcaec8793b68643affb30a
SHA1

2e66341c1d9f85ea19139fa83fcef3424f10a93a
SHA256

436ad6516dcb3802e9e18ea7a039a86f56ee3fdd18bec695222beb6ad625fd75
SHA512

6d6dc5d6da6828e88a9a31c3c2e972758589d064626381456b42e8c200b03d1907657ff7e4e4e1de106a4f52084b4b731df6353c33b6b6b156e9c8e6d2e53e33
SSDEEP

6144:9kAyKQ/dzRknvMFPtlAxyax1RkATPD8fINfUzl4Ogx5dQu2OdiGA4b7BIEtAMSTo:9kbKeBiwucAD4gNfUzxgFTiGAMGEmM0o

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

scb0

Decoy

introlly.com

slowtravelco.com

sasanos.com

3424soldbastrophwy.com

isabelaefernando.net

0754fm.com

meta-bot.xyz

778tt8.com

krallechols.quest

lipagent.com

dermaqueeniran.com

psychoterapeuta-wroclaw.com

marmorariapiramide.online

luxonealbery.com

floridawp.com

nebobuild.com

facillitiespro-sweep.com

wwgzj.com

puffsmoke.online

cryptofuelcars.com

Targets

- Target
  
  vbc.bin
- Size
  
  404KB
- MD5
  
  cf82630b65d8e29c59fd6254c1bb8df3
- SHA1
  
  023d37e9bf3a4f0af07e23db3630fb023902d9aa
- SHA256
  
  1ccf632888b773e7116eb3a4ade6017f064b5c98f71424e5c1cc8b4bcbe181ef
- SHA512
  
  095f653f4ba57019e781ff6b065a76c193c1987c94ab9dbfb24014f45a3cb06d3cafde51623002ba0c1a920f007ca26129fc7437db3777b74ac14d9f39ddc9ea
- SSDEEP
  
  12288:m1hpgPSDfOvZXBo1zMrLRQVjvf00t3/34s3ujfkXX:m17gwz6ob3P34aujI
Score

10^/10

xloader scb0 discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Deletes itself
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Deletes itself

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2