Overview

overview

10

Static

static

RCS76393.exe

windows7_x64

10

RCS76393.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RCS76393.exe
  • Size 377KB
  • Sample210408-1p81lph3ps
  • SHA256 5d1870672eff4e2ec6d699d654d5268051f7a56f8ca991fefa538eeef380a89c
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.batiktintaemas.com/goei/

Decoy

  • bet365o2.com

  • gulf-landlord.info

  • foodsystemsjusticeproject.com

  • ronwongart.com

  • fwgkdhg.icu

  • armanrugservice.com

  • mapadequito.com

  • vbkulkarni.com

  • ltsbinge.com

  • creativem2.com

  • mindflexlab.com

  • ushealthvisa.com

  • 247carkeyslondon.com

  • addthat.xyz

  • zanzan8.com

  • legendsalliance.net

  • shopflyonline.com

  • csgo-roll.net

  • reutbergcapital.com

  • mediaworkhouse.com

Targets

    • Target
      RCS76393.exe
    • Size 377KB
    • SHA256 5d1870672eff4e2ec6d699d654d5268051f7a56f8ca991fefa538eeef380a89c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks