Overview

overview

10

Static

static

1

SecuriteIn...92.exe

windows7_x64

10

SecuriteIn...92.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Jaik.44831.27142.27292
  • Size 216KB
  • Sample210331-bbb4ne8p8s
  • SHA256 40628d32ef0746f397d0d41b839530eae24d249dd2f414450a8d9dda03741d10
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.fountainhead410.com/jzvu/

Decoy

  • rezabird.com

  • amthebomb.com

  • cqfsc.net

  • scottgesslerdesign.com

  • australianhempco.com

  • digitalkn.com

  • theoneandonlytattoostudio.com

  • chaing-list.xyz

  • technicaljanu.com

  • tigerkid.net

  • mels.ink

  • adassadelacruz.com

  • deep-freezers.xyz

  • kundanbangles.com

  • 88840678.com

  • xiaonaphotography.online

  • john-heer-stuttgart.com

  • gumrukihalesi.com

  • veekasdoshi.com

  • purathanam.com

Targets

    • Target
      SecuriteInfo.com.Variant.Jaik.44831.27142.27292
    • Size 216KB
    • SHA256 40628d32ef0746f397d0d41b839530eae24d249dd2f414450a8d9dda03741d10
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks