Overview

overview

10

Static

static

3

b9753e6a4e...cs.exe

windows7-x64

10

b9753e6a4e...cs.exe

windows10-2004-x64

7

hybreieskm.exe

windows7-x64

3

hybreieskm.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe

  • Size

    202KB

  • Sample

    240524-1nyg5sce48

  • MD5

    b9753e6a4e25385083221adf8dc6d5b0

  • SHA1

    ba627129085d90cff569c40e65649155edc0572d

  • SHA256

    c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

  • SHA512

    6ee9bcaf5eff303ebcf7d7992635bd5244cead4051ee42a87c5fd8dbdc67786c8c2434dc5ccc5536f4f01d51d416ed3cacc4d9487ce7cfaa6c1445a0b0a79bd2

  • SSDEEP

    3072:114/IIhEDnmJL+ulN45BwNSoRZ7HYIh5PihD1Ypwh1shYeex+tvton02:1be4zwSoRZ7vSJOiAhY+tVonn

Score
10/10
xloaderzgtbloaderrat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Targets

    • Target

      b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe

    • Size

      202KB

    • MD5

      b9753e6a4e25385083221adf8dc6d5b0

    • SHA1

      ba627129085d90cff569c40e65649155edc0572d

    • SHA256

      c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

    • SHA512

      6ee9bcaf5eff303ebcf7d7992635bd5244cead4051ee42a87c5fd8dbdc67786c8c2434dc5ccc5536f4f01d51d416ed3cacc4d9487ce7cfaa6c1445a0b0a79bd2

    • SSDEEP

      3072:114/IIhEDnmJL+ulN45BwNSoRZ7HYIh5PihD1Ypwh1shYeex+tvton02:1be4zwSoRZ7vSJOiAhY+tVonn

    Score
    10/10
    xloaderzgtbloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      hybreieskm.exe

    • Size

      5KB

    • MD5

      3fe13edd25a0779eb87727b4ce3d7818

    • SHA1

      16527b946c3694d83d3e7d8c452ad681a678208f

    • SHA256

      fce6d2715739d7b855a83771d1c6a3e2822d625ca490b990a2908afba8df1dfe

    • SHA512

      fd2b1a8cbd4bc408d3ca283389ba4a87c8421837f8edfe3b98e1bf9ca3a478369103f8cc57a8f8b3d364e637b30c3eafd423249b5ceb4f2e3cc13ca02db44cf4

    • SSDEEP

      48:vpgnzgb33oMBogjqnWDcsVpXUypXUBq+3nNZ8QN6WNSqG3Y+O1z55quQvnRh:BfjDvbXlXR+3NHoWryY+O1z2uuRh

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks