Overview

overview

10

Static

static

SecuriteIn...46.exe

windows7_x64

10

SecuriteIn...46.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Scr.Malcodegdn30.30485.9846
  • Size 688KB
  • Sample210301-ec14jf15mx
  • SHA256 73542f2e6652897764dfeeffa70ebc1ccebeb5681bc7a049ec875771c995aa4a
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.unicapnutrition.com/ubkk/

Decoy

  • centroopticointegralleon.com

  • nascum-virex.com

  • republicofdrones.com

  • akhurricanebullies.com

  • plantextractdiet.xyz

  • store-google-play.com

  • easyfinace4u.com

  • testprice.info

  • arosethatrises.net

  • maddenmarketinggroup.com

  • brevardhomeoffers.com

  • ruvidowines.com

  • xn--220bk3rwua50y.com

  • saturdaybiryaniparty.com

  • thedoughmad.com

  • bluegrassmeadows.net

  • abalonedesign.com

  • thecrepegallery.com

  • jake4missouri.com

  • emjaesmarket.com

Targets

    • Target
      SecuriteInfo.com.Scr.Malcodegdn30.30485.9846
    • Size 688KB
    • SHA256 73542f2e6652897764dfeeffa70ebc1ccebeb5681bc7a049ec875771c995aa4a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks