xloader

Sharing

Copy URL Twitter E-mail

General

Target
Calendar.exe
Size 799KB
Sample260312-31mbraex2y
SHA256 26e9a6c6cd87bd362de79a9557f2b08aa030a80cb9a182e709cba046b9c8a98a
MD5 518c618f22b1b55ad13a3a2f83792bf4
SHA1 8d462ed03ff861ee56d1229f4b128dd429da5aa2
SHA512 84e01702aa1b54b1703fefb6b6634b29627b293e0f3a0207524fca3a4a2f10efa5b71aaebfb72337b31633aaa27d7a5024ce1a74a8426ba1f61547080836ca85
SSDEEP 12288:kJp5oqRasUrtUtIevx0fpTDCvTbmqaubHnz4BK0hq2ueuHVdleJ3Lfg+bc0iid6E:2Rvbt5Z0fpOugu42Z6N
TLSH
T129058CBD703279EECDABC2398B346D6C9F5572BBC20B223650576559488CB838F62473
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

sgs8

Decoy

epptexportools.com
theweddingofshadiandmike.com
588movie.com
deannahayko.com
smithkenney.com
mogurin-blog.com
heffner.host
nflflex.com
tshirtcustomdesign.com
livingwithinstinct.com
hanbangvu.com
5starsct.com
jystainlesscoil.com
lechazosdeliebana.com
northeastcampervans.com
halloweeneventsinmiami.com
wellnesswithshami.net
mklaboratories.com
oilepp.club
ravexim3.com
loanez3.com
smootied.com
jenarie.com
itescorts.com
lualmodasmg.com
soicauchuannhat.club
aandjwedding.com
dcoflywheel.com
backstorymagazine.online
armorsolo.icu
sameday.one
contemporaryartmuseum2020.com
pankeys.com
mablemitchell.com
3261laurelcanyon.com
haniyaghani.com
modacimiz.com
recodive.com
nogetincrease.com
xwf.xyz
9jinbo.com
agriktechnical.com
ameri.loans
5522n.xyz
icimprovement.com
mangalyampano2vr.online
holakozf.net
creditsuisweb.com
torvick.space
latournette.com
rahbaranrealty.com
xn--cckb9dwfpeue0736a0i9c.xyz
leftytorighty.com
ugurcoruh.com
bestforreaders.com
renegadeetc.net
ucakbiletle.com
mesynthes.com
thelawnbowlingmanager.com
whiteanglepod.com
shuangli56.com
janerowenlester.com
lightningbike.com
helpfulproduction.com
byfarruco.com

Targets

- Target
  Calendar.exe
- Size 799KB
- SHA256 26e9a6c6cd87bd362de79a9557f2b08aa030a80cb9a182e709cba046b9c8a98a
- MD5 518c618f22b1b55ad13a3a2f83792bf4
- SHA1 8d462ed03ff861ee56d1229f4b128dd429da5aa2
- SHA512 84e01702aa1b54b1703fefb6b6634b29627b293e0f3a0207524fca3a4a2f10efa5b71aaebfb72337b31633aaa27d7a5024ce1a74a8426ba1f61547080836ca85
- SSDEEP 12288:kJp5oqRasUrtUtIevx0fpTDCvTbmqaubHnz4BK0hq2ueuHVdleJ3Lfg+bc0iid6E:2Rvbt5Z0fpOugu42Z6N
- TLSH
  T129058CBD703279EECDABC2398B346D6C9F5572BBC20B223650576559488CB838F62473
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

sgs8 discovery xloader loader rat
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader family
  xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Xloader family

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2