Overview

overview

10

Static

static

3

65b8d28cc9...ff.exe

windows7-x64

10

65b8d28cc9...ff.exe

windows10-2004-x64

7

$PLUGINSDI...ds.dll

windows7-x64

10

$PLUGINSDI...ds.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8d5f3e6a3e8652eeb94d0fc8c214bef10f0e2557ffe655ff1e3684edd565221

  • Size

    238KB

  • Sample

    241121-ytpq3swmg1

  • MD5

    103eafa5713342cefc443f6f20a53e0d

  • SHA1

    224250cf8a60e9c181cd9c0740d8ab1600ca173f

  • SHA256

    c8d5f3e6a3e8652eeb94d0fc8c214bef10f0e2557ffe655ff1e3684edd565221

  • SHA512

    6d913b1ebc05fe93c259acf187346f2fc362d9a99cd2690ce18908e617ecf5c32cd83c2507b410a37a892d3cc37b5d8e4ca4ad8c10c7bd538ad118490fde77a7

  • SSDEEP

    6144:TqMWUArrh1NVdE2/vt8N77qKnLHpJG9eMrBoYLt/BXddiN:Tq7rh1dDqV75HXGwMKs9iN

Score
10/10
xloaderoqxsdiscoveryloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

oqxs

Decoy

northkoreamatrimony.com

we11studio.net

ekviraonewaycab.com

biakbiak.com

pdmclinic.com

biophots.com

shaydd.com

uplandpro.com

newcrestredchrisltd.com

aventuragaming.com

righteousrewards.com

pengwinz.com

ganey-hn.com

gz-bbe.com

xicauyb.com

historyfive.com

racofix.net

teetimeforyou.com

perfumeriadeverano.com

electrumkeys.works

Targets

    • Target

      65b8d28cc93ef078954f569422e9292298e638a11a6bb681c85065c84e042bff

    • Size

      251KB

    • MD5

      5da62bdb6889d90f395efd87681ebdc7

    • SHA1

      d6d8cfb0f3bec3b693b805a8bdeefe3651b6d509

    • SHA256

      65b8d28cc93ef078954f569422e9292298e638a11a6bb681c85065c84e042bff

    • SHA512

      5c896c8506557c8df0fe44272557e40c3c312458ceea7dfdcd8449438f6b51de0a25aa0d128c77a534142bfa1c345b65075f7e353e515e477693a75aa54d99c8

    • SSDEEP

      6144:p8LxBntcE0yoInozz1mZOoEFmAckF5rTKqdacxIiSgIF3CFbW:EuE0yAVsI4yPbaQBSgIFyFi

    Score
    10/10
    xloaderoqxsdiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/gbywalds.dll

    • Size

      12KB

    • MD5

      5b7950419e981b94f2d78ba5f70b8f47

    • SHA1

      007b19f9267c8634a7b4b488770ae1f667655c20

    • SHA256

      6e11a5bb985683f9d03865289565124c11ce2c481a9a505866602cc950c80f5e

    • SHA512

      03d2a63385fa404e3fec62b16af9baa3ae93c26250e3ab1b104b6bb42542a7690d182faa50c5f27e89d4a8d00306ba252a188df9109667ca964ba80640882e65

    • SSDEEP

      192:KBGz5UZNGzZmzQnR4XrQiE+BZ2jrEQN/MOm6yD4yht/8RR0A:aGnmzsaZEpfj9nyD4su

    Score
    10/10
    xloaderoqxsdiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks