Overview

overview

10

Static

static

swift_43543.exe

windows7_x64

10

swift_43543.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    swift_43543.exe
  • Size 814KB
  • Sample210322-8tg69llyke
  • SHA256 2dc07e970dd5581d1bd22d69e454dceda70d8f87cc84757f86c094b2fdb7f985
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.nutrigabrielacarvalho.com/m8es/

Decoy

  • 668ruby.com

  • bundlecableinternet.com

  • principal.properties

  • autumnpmx.com

  • guiadeourobr.com

  • e6onlinetour.com

  • aireservcoastal.com

  • adzamstore.net

  • lights-touch.com

  • outsourcingjuridique.com

  • eicgmbh.com

  • hicapitolize.com

  • poikaewf.com

  • xn--hndmixer-9za.info

  • mondopeak.com

  • sczhuangzhou.com

  • treeworxpros.com

  • hurricanelauraroofing.com

  • dt-hnjx.com

  • letopicy.com

Targets

    • Target
      swift_43543.exe
    • Size 814KB
    • SHA256 2dc07e970dd5581d1bd22d69e454dceda70d8f87cc84757f86c094b2fdb7f985
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks