xloader | 8fbb76de2ae2820561ddb6da32c0274d2472521f83a8a42ba7dd4a17d8a8a752

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_12611552642_eml_kenny_june.zip
Size 1.3MB
Sample260917-wtpd7sww6m
SHA256 8fbb76de2ae2820561ddb6da32c0274d2472521f83a8a42ba7dd4a17d8a8a752
MD5 8971debb614b7b6622c49b8c9c3a804a
SHA1 3fa886c6299f27cbe14e2ceb96abcc42ebd11bdc
SHA512 92e2c0af3c3ed0fd7c3ac7cc7317680ed990cf1771707f1a7fc3c0ff043379c74c1c670674511d2356c15dc037fdc8a08692ef56364fb1379e310d292f5e9d32
SSDEEP 24576:jQlk+X+ArZvgRv73P+2vS9ENuyrUVG3wSW3p2iPrDqZ2K:L+X+kZvgRv7XtNuyQnSQp2iPrDpK
TLSH
T1EF55331D169C15E3C781A103F7247720A8E6E28BB67C7765AEBB1B0F356D12E16F0C29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xloader

Version

Campaign

hfhf

Decoy

richardjfreeman.com
malapeca.cat
fattygay.com
queroleads.com
kisfor.xyz
metodoenriquecimento.net
santaclausbook.com
erinnandmike.com
fscehd.com
aroundthesoundrealty.com
racevideoindex.com
mediafacing.com
solarnurd.com
bhulbhulaiya.com
jybv.website
akquaa.com
visionbeyondthelight.com
bunerden.net
xupersports.info
gititngit.com
cuerpodance.com
makersmarkfashion.com
citi1realestate.com
pe004.xyz
name-your-ent-forum.com
philippinesmorningpost.com
amaliebolt.com
nibblecards.com
digitalsolituderv.com
commytvcom.com
metaretailtherapy.com
drelens.com
sportschuetzen.club
feiyu16888.com
gg571gg.com
csbantuanid.com
sxkoe.sbs
liftmountainfitness.net
red-lover.com
mediamalam.com
sbx-pro.com
eclecticmementos.com
grenanimaldapp.com
imoveisemmilagres.com
marsenne.com
vogl.website
prosto-b.com
sdgsoutions.com
therapyinabottle.com
trusttribune.net
180lhzs.com
blessthistable.site
danegames.com
piercingpezoninvertido.com
creativelybreweddesigns.com
dakonerp.com
jzshhgsb.com
rapidertcfunding.com
thenitricoxideexperts.com
teleiig.com
mexcwebs.com
ilaaik.com
roserouge-store.com
hugear34.com
dltssl.com

Targets

- Target
  20220421003-Invoice&Packing-Sea.xls.scr
- Size 919KB
- SHA256 70b553283499a6cf11c572d13334343d6c134b95ac28e7deccf20ac28c1cd09c
- MD5 1e39e04e56e961f0447315af89baaaeb
- SHA1 46aba8054a45868f5d5b081b932600f998b30b93
- SHA512 ff2f48e42365f9ee9b755d10e88cd22d701cbf6a2d8d59c911576c5a4544e8bdb1ef12b7dd1e51a707b2aae1442c4ec98cce0e1233d47ef435d97af26b735b8f
- SSDEEP 12288:Wpe3brWO2ms1lYycBngjf/DRdGFFC0Jad45OiIq3sZ+Uzm0OGe4iPaQ9+nl:Wpe3X2uBC3mFFnJFV3shWGKPaQ0l
- TLSH
  T17E15F13297F4492EDB6F833C54B28300573C668BC295E7CE5653F2BD0AE3B0255896A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hfhf discovery xloader loader rat
- Family: Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- KoiVM .NET virtualizer plugin for ConfuserEx
  Detects KoiVM .NET virtualizer plugin for ConfuserEx
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Global Library - Vessel Schedule Change for PNW1 E.pdf.scr
- Size 919KB
- SHA256 70b553283499a6cf11c572d13334343d6c134b95ac28e7deccf20ac28c1cd09c
- MD5 1e39e04e56e961f0447315af89baaaeb
- SHA1 46aba8054a45868f5d5b081b932600f998b30b93
- SHA512 ff2f48e42365f9ee9b755d10e88cd22d701cbf6a2d8d59c911576c5a4544e8bdb1ef12b7dd1e51a707b2aae1442c4ec98cce0e1233d47ef435d97af26b735b8f
- SSDEEP 12288:Wpe3brWO2ms1lYycBngjf/DRdGFFC0Jad45OiIq3sZ+Uzm0OGe4iPaQ9+nl:Wpe3X2uBC3mFFnJFV3shWGKPaQ0l
- TLSH
  T17E15F13297F4492EDB6F833C54B28300573C668BC295E7CE5653F2BD0AE3B0255896A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hfhf discovery xloader loader persistence privilege_escalation rat
- Family: Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- Xloader payload
  rat
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- KoiVM .NET virtualizer plugin for ConfuserEx
  Detects KoiVM .NET virtualizer plugin for ConfuserEx
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Xloader

Xloader payload

ConfuserEx .NET packer

KoiVM .NET virtualizer plugin for ConfuserEx

Suspicious use of SetThreadContext

Family: Xloader

Xloader payload

ConfuserEx .NET packer

KoiVM .NET virtualizer plugin for ConfuserEx

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4