Overview

overview

10

Static

static

1

7bb3ddc9ac...b4.exe

windows7_x64

10

7bb3ddc9ac...b4.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7bb3ddc9ac5af80eef93b19df83a07b4.exe
  • Size 219KB
  • Sample210310-2377m6ktb6
  • SHA256 a429373a65c453931ad3cf7fcc897520d2ac11da688577e0dee6f4d36e7cc030
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.hikayemedya.com/smd0/

Decoy

  • startzassets.com

  • airpodslink.com

  • justsomerandomthoughts.com

  • stellarbookkeeping.com

  • elewintool.com

  • mysticalpalmist.com

  • pvpla.com

  • creamclinic.com

  • authorsanonymous.net

  • reflexologie-wellness.com

  • wabcoautoproducts.com

  • healthyliving1.net

  • gaydate.space

  • blackloveapparel2020.com

  • tofaniinternational.com

  • allo-allo.com

  • sachatco.com

  • scamregister.net

  • vib7.com

  • realtnyp.com

Targets

    • Target
      7bb3ddc9ac5af80eef93b19df83a07b4.exe
    • Size 219KB
    • SHA256 a429373a65c453931ad3cf7fcc897520d2ac11da688577e0dee6f4d36e7cc030
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks