xloader | 5c781ff18369f5349795140b88e95ca7b9b1916b47f2aa03ac59de323054c04c

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-05_ab868019b3681f000f5878f5f7ca7429_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 434KB
Sample260505-sa2zeaav7x
SHA256 5c781ff18369f5349795140b88e95ca7b9b1916b47f2aa03ac59de323054c04c
MD5 ab868019b3681f000f5878f5f7ca7429
SHA1 e832ac42ec8423b556bf4c5097de048590fa3269
SHA512 91720f385d25ca9687966f25d9dcb0551c9e15ff821206ebacde18ae745a9e896f32a4c002983967ec5c11bfd84dc482dd88deca12d7a4823485db6e8e8697e7
SSDEEP 12288:Sd5qRTBltDnQyDCdLAdpKVI2mzMh0ytejyrCer5+nH:Sd5CBbsQCJAdGI295Wyr6
TLSH
T19794CF09B689D0F3C973093A88F45275563A7A712B1A1AEB2BC4576D4F361C06E32F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

hsan

Decoy

cineruelles.com
houstonbuyhouses4sale.com
team-me.com
snowremovalfredericton.com
italianinperu.com
lapalmaelsalvador.com
tattooberga.com
blacklivesmad.com
iowapaymentrelief.net
pitmaster.pro
3907allendale.com
phelieutienphat.com
faishonhunt.com
aretens.com
beatsbydrdre.sucks
accurateupdate.com
ctsafaris.com
kuroi-kingyo.com
xaydungdaiphattn.com
runearfit.com
niboshiyahonpo.com
otestore.club
nova-solarpower.com
bossedupnative.com
baliholisticcollective.com
loveletout.com
bestrouters2021.com
iowalandgal.com
santajimsworkshop.com
goedkoopstevakanties.com
mightywordtutoring.net
sofiaschulz.com
v499.net
caifa-wooden.com
guardiantechnologoes.com
tgnbnaoio.com
beastmodexpress.com
salonbardacipres.com
xn--8dbabpvt6d.xn--9dbq2a
disorder-symptoms.com
traanscend.com
simonkoelewijn.com
rhlrfqxzra.net
sourcing.contractors
thinkingdiversity.net
bulukx.com
theislandcookhouse.com
xn--hy1bj7giwitfj76d.com
yibinchuangtian.com
wdzs0537.com
aaarehabfunding.com
revisionistclothingco.com
joealwyn.net
theminispycam.com
lavanderiaordaz.com
mobilefirehousefitness.com
indiaartandrugs.com
affiliatemillionaires.show
windowfilmtoprotectturf.com
crossvilledermatology.com
ciffamiliar.com
omahcake.com
braxmaier.net
kj998.pro
oraclerate.com

Targets

- Target
  2026-05-05_ab868019b3681f000f5878f5f7ca7429_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
- Size 434KB
- SHA256 5c781ff18369f5349795140b88e95ca7b9b1916b47f2aa03ac59de323054c04c
- MD5 ab868019b3681f000f5878f5f7ca7429
- SHA1 e832ac42ec8423b556bf4c5097de048590fa3269
- SHA512 91720f385d25ca9687966f25d9dcb0551c9e15ff821206ebacde18ae745a9e896f32a4c002983967ec5c11bfd84dc482dd88deca12d7a4823485db6e8e8697e7
- SSDEEP 12288:Sd5qRTBltDnQyDCdLAdpKVI2mzMh0ytejyrCer5+nH:Sd5CBbsQCJAdGI295Wyr6
- TLSH
  T19794CF09B689D0F3C973093A88F45275563A7A712B1A1AEB2BC4576D4F361C06E32F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hsan discovery xloader loader rat
- Family: Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Xloader

Xloader payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2