Overview

overview

10

Static

static

80c6396c02...7f.exe

windows7_x64

10

80c6396c02...7f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    80c6396c022d1af34979e7b42ee7797f.exe
  • Size 745KB
  • Sample210331-ghc1nms9m6
  • SHA256 7a4de78c5eed937a8aa4e3149fac38d38fd0275ddc45b2a481f266c421230e5d
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.paintersdistrictcouncil.com/vu9b/

Decoy

  • longdoggy.net

  • gylvs.com

  • evonnemccray.com

  • nicemoneymaker.com

  • baby-schutzen.com

  • xgahovzm.icu

  • psdcompany.com

  • makeupjunkiewholesale.com

  • vz357.com

  • carshownet.com

  • forneyus.com

  • nfoptic.com

  • lampacosmetiques.com

  • newmandu.com

  • localupdate.net

  • theartofmajur1.com

  • bancosecurity.website

  • cabinhealthy.com

  • tiprent.com

  • lloydwellsandassociates.com

Targets

    • Target
      80c6396c022d1af34979e7b42ee7797f.exe
    • Size 745KB
    • SHA256 7a4de78c5eed937a8aa4e3149fac38d38fd0275ddc45b2a481f266c421230e5d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks