xloader

General

Target

095ed1970fa8aa0017257b6e8607d0b12e69c59db0977c8e0f4cc48aa871d855
Size

450KB
Sample

241121-zeqv9s1rek
MD5

f143a9ca190a4650997413bf201ae0ff
SHA1

e5d8d9bc45e48b82b5eaf5295d5ab4e7c80bee6c
SHA256

095ed1970fa8aa0017257b6e8607d0b12e69c59db0977c8e0f4cc48aa871d855
SHA512

1e4895d34c999c53de0a9318ad79c3912e0d39b1db733f968d665670333d545712d1fab518f7b3effdf850a7a0b3d36e894bc3e774303eefd84aa37eccb92016
SSDEEP

12288:plAGz0J2E05LWeyqniKLHnjAZ/sXaFQfxmh+I3jo9roF+WdZi:pK80J2p5qhv0HjAdEa2xmNASTi

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

sa3t

Decoy

mendazilima.quest

britishdrivers-uk.online

clear-rails.com

emagrecacomsaudesempre.online

sppn.info

prestigepropiedadraiz.com

therenewalprojectmastermind.com

mileylovu.com

lmhaglund.com

apentrenadores.com

charminggrooming.com

pgonline888.online

powify.net

deadlyubohe.quest

testimonial.direct

59sth.com

scbnetcomn.xyz

gejservices.com

kemalilik.com

romcollectionmelbourne.com

Targets

- Target
  
  b3900840680fa44a29ea2ec2b9491636923a2dc344aef954608affc086db6451
- Size
  
  461KB
- MD5
  
  5157cd51759c1d877b4c5ccfb814782c
- SHA1
  
  420311eefd515627c13b604029e215faac68241c
- SHA256
  
  b3900840680fa44a29ea2ec2b9491636923a2dc344aef954608affc086db6451
- SHA512
  
  ef9e6cddcce9cbad73a28406fb2bdbc79fd62af9ef095c0c909877cebb025495f97bcfc6f7f43fb0d019a60938efb11612baa41371bc0aebc9e1cb3381c7e718
- SSDEEP
  
  6144:rGil67ZStrhh0ZZP3/EsT/2uLz/aebbHuFFFkDtrfS8cy/sGxBjKGH8Hjn+o5F:pf0ZPLx1PcmtS8c29BjKhF
Score

10^/10

xloader sa3t discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/bdumzguwre.dll
- Size
  
  324KB
- MD5
  
  0a45dfba55b0a8a259393117a5ba0795
- SHA1
  
  da5e641a9d8ba850fd14fbc7c0a0c339adb6b538
- SHA256
  
  37c5b32148a16e741c548a7dfc3811b2d10bf3a35d753b5b27b1aae7e7ab5817
- SHA512
  
  5bea4192eb222c9d83e5a753a2f66df5b97a340bbd7dd6cc2575d83be1846e6db06187004f886bc54b84793558e93bb1ea20f40123ac3382b703d201f52aa5d9
- SSDEEP
  
  6144:HiTVctYV+wZaxVTnCfuj1trHRcWGzsQDk3KPlinS++YPH8r:Hi6tYVVaLRJtrxcb7cAinv+YP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4