xloader

General

Target

fb87b4368253ea2b65518b377a9aad680f4a809cba2246bf90dab8a9dfe6bb7b.exe
Size

588KB
Sample

241122-m6ynzayrhv
MD5

80457ed80eafe07d9dd3ffb9179ea01c
SHA1

7637c854b29e7a33bf69b5a1d7dd09ad24bd3134
SHA256

fb87b4368253ea2b65518b377a9aad680f4a809cba2246bf90dab8a9dfe6bb7b
SHA512

f1f17b3e8a63ad65a45f2a0e58e4a34e2e6dab08e87c5412eddb3e45dd81aef18dcd276972e5cd04901b87d88e5c317fdaafc1fc41fcd34a5d1ad04c2c88892f
SSDEEP

12288:pr3bUzN/1YCKK+NZx2UO3bQPy7LFOhsReHHW:o/KKiZxhwbQPy7JOyRenW

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

- Target
  
  fb87b4368253ea2b65518b377a9aad680f4a809cba2246bf90dab8a9dfe6bb7b.exe
- Size
  
  588KB
- MD5
  
  80457ed80eafe07d9dd3ffb9179ea01c
- SHA1
  
  7637c854b29e7a33bf69b5a1d7dd09ad24bd3134
- SHA256
  
  fb87b4368253ea2b65518b377a9aad680f4a809cba2246bf90dab8a9dfe6bb7b
- SHA512
  
  f1f17b3e8a63ad65a45f2a0e58e4a34e2e6dab08e87c5412eddb3e45dd81aef18dcd276972e5cd04901b87d88e5c317fdaafc1fc41fcd34a5d1ad04c2c88892f
- SSDEEP
  
  12288:pr3bUzN/1YCKK+NZx2UO3bQPy7LFOhsReHHW:o/KKiZxhwbQPy7JOyRenW
Score

10^/10

xloader fqiq discovery loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2