Overview

overview

10

Static

static

1

siam.exe

windows7_x64

10

siam.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    siam.exe
  • Size 252KB
  • Sample211019-d9c21afbf4
  • SHA256 b207cf6e0fe84692f4311e2768d913bae8005da5f7ed4cf1cee2459a6f62faa9
  • MD5 SHA1 SHA512
Score
10/10
xloaderw240loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • w240

C2

  • http://www.palisadesburgers.com/w240/

Decoy

  • deathgummys.com

  • accentuable.info

  • logisticairpetrelocators.com

  • playdropmats.com

  • ewshop.club

  • bislists.com

  • pkkjoo.net

  • goldenkaktus.com

  • bigspiderproductions.com

  • funessences.com

  • gimpydogproductions.com

  • motivatedmarketinggroup.com

  • bjadd.com

  • 2ux3ms.com

  • zafzi.com

  • oldmanemailplan.xyz

  • quotexlibya.com

  • mobco.store

  • stofferogbo.kim

  • akidsguidetotheworld.com

Targets

    • Target
      siam.exe
    • Size 252KB
    • SHA256 b207cf6e0fe84692f4311e2768d913bae8005da5f7ed4cf1cee2459a6f62faa9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderw240loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks