Overview

overview

10

Static

static

1

df235a9e8e...04.exe

windows7_x64

10

df235a9e8e...04.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    df235a9e8ee343e450eb35319054b704.exe
  • Size 211KB
  • Sample210317-6qttaehmts
  • SHA256 7e88f1c425154e6fff6d031aaaa4d8bb4c8ff131e429f44310fd936bfc08b357
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.856380692.xyz/nsag/

Decoy

  • usopencoverage.com

  • 5bo5j.com

  • deliveryourvote.com

  • bestbuycarpethd.com

  • worldsourcecloud.com

  • glowtheblog.com

  • translations.tools

  • ithacapella.com

  • machinerysubway.com

  • aashlokhospitals.com

  • athara-kiano.com

  • anabittencourt.com

  • hakimkhawatmi.com

  • fashionwatchesstore.com

  • krishnagiri.info

  • tencenttexts.com

  • kodairo.com

  • ouitum.club

  • robertbeauford.net

  • polling.asia

Targets

    • Target
      df235a9e8ee343e450eb35319054b704.exe
    • Size 211KB
    • SHA256 7e88f1c425154e6fff6d031aaaa4d8bb4c8ff131e429f44310fd936bfc08b357
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks