Overview

overview

10

Static

static

Swift.exe

windows7_x64

10

Swift.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Swift.exe
  • Size 747KB
  • Sample210331-sk1861eemj
  • SHA256 4e5290b59d085d2d8492782191609fb2847e2f4a554b2ca48d1e7d7c86f6fb92
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.trendyheld.com/edbs/

Decoy

  • ehealthak.com

  • kingdavidtiferetshop.com

  • allincursive.com

  • quickshop.xyz

  • hallfaxgroupuk.online

  • barebeautybrand.com

  • verificationpays.com

  • 2k20-aide.com

  • cameralogs.com

  • blackdotdesignco.com

  • thepredictable360.com

  • huangguanlin600270.com

  • hounslowkebab.com

  • kuppers.info

  • ohjoephoto.com

  • bhavyaarora.com

  • thecoolprojector.com

  • abelprocess.com

  • 856379765.xyz

  • growth.run

Targets

    • Target
      Swift.exe
    • Size 747KB
    • SHA256 4e5290b59d085d2d8492782191609fb2847e2f4a554b2ca48d1e7d7c86f6fb92
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks