Overview

overview

10

Static

static

32a337e8ac...5f.exe

windows7_x64

10

32a337e8ac...5f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    32a337e8ac0912ec32e54553a0db095f.exe
  • Size 270KB
  • Sample210329-tmn4799l4e
  • SHA256 f86b0f3ec06d574080bd86e2980c7d04c29d4093d025fe592a567b5767031d2b
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.scott-re.online/nnmd/

Decoy

  • bongwater.life

  • regalparkllc.com

  • gyanankuram.com

  • quehaydecenarhoy.com

  • israeldigitalblog.net

  • gatewaygaurdians.com

  • krphp.com

  • domentemenegi47.com

  • fjsibao.com

  • yetbor.com

  • goldenvalueable.com

  • finalexam-thegame.com

  • buyeverythingforbaby.com

  • phillydroneservices.com

  • xn--kck4cd0r.net

  • suns-brothers.com

  • xn--80aaxkmix.xn--p1acf

  • pjsgsc.com

  • 7985699.com

  • blackmantech.fitness

Targets

    • Target
      32a337e8ac0912ec32e54553a0db095f.exe
    • Size 270KB
    • SHA256 f86b0f3ec06d574080bd86e2980c7d04c29d4093d025fe592a567b5767031d2b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks