Overview

overview

10

Static

static

1

TNT EXPRES...TS.exe

windows7_x64

10

TNT EXPRES...TS.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TNT EXPRESS SHIPPING DOCUMENTS.exe
  • Size 213KB
  • Sample210316-pv2c7162c2
  • SHA256 727bc43e3d9cdf3e79c2232cf3f647bdf94ad2012c31403434c17e5bbeb3c339
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.christopherngai.com/boit/

Decoy

  • kuhanticiy.site

  • rosecoline.com

  • lapertuna.com

  • fedeschwalb.com

  • cvstore1.com

  • 761215.com

  • secretivecriticaldeeply.net

  • 2503322.com

  • zhongda8.com

  • xsynergysip.com

  • hologramhell.com

  • argetench.com

  • rsmenterprises.net

  • sunsasound.com

  • thietbinuoc.com

  • proofreadingbypaulina.com

  • apnidukan.life

  • petsmartapp.com

  • raumluftraum.com

  • whitehorseavon.com

Targets

    • Target
      TNT EXPRESS SHIPPING DOCUMENTS.exe
    • Size 213KB
    • SHA256 727bc43e3d9cdf3e79c2232cf3f647bdf94ad2012c31403434c17e5bbeb3c339
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks