Overview

overview

10

Static

static

1

51beebfe86...96.exe

windows7_x64

10

51beebfe86...96.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    51beebfe8676115fc2a11686b9817396.exe
  • Size 207KB
  • Sample210323-lgalct4f7j
  • SHA256 ebb6267e5c3bf10ec8ccba29d6fd2c7b747cef8b758db1544caf9edc7f117d7b
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.alphaonemediagroup.com/m0rc/

Decoy

  • the-smart-light.com

  • dashite.com

  • cwdunlaptruckinginc.com

  • hardcoreporn.club

  • mediacombb.info

  • zuot-1.com

  • mediabelajardigital.com

  • rbc-supportclient05.com

  • puertovallartahouse.com

  • valentinaasia.com

  • tunes4tinder.com

  • fermenteddough.com

  • tipsindah.com

  • jpsaledevelopment.asia

  • amrdiabcafe.com

  • spsd-test-predators07.xyz

  • biandanmall.com

  • uselessmajors.com

  • valiantrunners.com

  • osoandmaxz.com

Targets

    • Target
      51beebfe8676115fc2a11686b9817396.exe
    • Size 207KB
    • SHA256 ebb6267e5c3bf10ec8ccba29d6fd2c7b747cef8b758db1544caf9edc7f117d7b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks