xloader

General

Target

61513e3002d53144e302a97f62382f19e9e4fbd3c820c1e0000cc793a5b7a2d3
Size

523KB
Sample

241121-zc1bxsxlex
MD5

0a5203e9b9b75f2c840989cf846a3cc5
SHA1

06720790a4728ad08530373117a10e2769d6833e
SHA256

61513e3002d53144e302a97f62382f19e9e4fbd3c820c1e0000cc793a5b7a2d3
SHA512

407f8e7826da334346c4d474e884aebdd0618390aaf7de12e96112acd05e74d7546d69cd5b59781145f0d57450442fb1e98ba032db115adcaf997172c18e5a59
SSDEEP

12288:uMNfJRiS6pxyynOiptzBsri2Lsg84uSB:usudXQiCri24V4zB

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mc6b

Decoy

packyssportsbarandgrill.com

catherinemata.com

swooningheartsenterprises.com

miss-notary86.com

applianceson.website

investormonks.online

lootproject.art

adoletakids.com

searchlink7.com

msjoyjewelsunlimited.com

dannisdolls.online

premierpor.xyz

geceseks.com

camdaw.xyz

ditrixmed.store

yotosunny.com

asdeformar.com

lacofood.com

nu865ci.com

verdantgomkte.xyz

Targets

- Target
  
  61513e3002d53144e302a97f62382f19e9e4fbd3c820c1e0000cc793a5b7a2d3
- Size
  
  523KB
- MD5
  
  0a5203e9b9b75f2c840989cf846a3cc5
- SHA1
  
  06720790a4728ad08530373117a10e2769d6833e
- SHA256
  
  61513e3002d53144e302a97f62382f19e9e4fbd3c820c1e0000cc793a5b7a2d3
- SHA512
  
  407f8e7826da334346c4d474e884aebdd0618390aaf7de12e96112acd05e74d7546d69cd5b59781145f0d57450442fb1e98ba032db115adcaf997172c18e5a59
- SSDEEP
  
  12288:uMNfJRiS6pxyynOiptzBsri2Lsg84uSB:usudXQiCri24V4zB
Score

10^/10

xloader mc6b discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2