Overview

overview

10

Static

static

SecuriteIn...84.exe

windows7_x64

10

SecuriteIn...84.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184
  • Size 378KB
  • Sample210408-4nb26jssqe
  • SHA256 5bcba2a09d8758ca07490dfcd3859a64b3a0092ed7873a707e73346eefd4235e
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.gailrichardson.com/qjnt/

Decoy

  • funeralinsurancetoppro.info

  • californiaredstate.com

  • xn--jpr220deud640b.com

  • playx.finance

  • siamfellow.com

  • tekirdagvethelp.com

  • forrealmodels.com

  • desenergie.info

  • whynotplus.com

  • graniteinaminute.com

  • satgurucolorlabs.com

  • potviper.com

  • racevx.xyz

  • thebluefishhotel.net

  • elletesla.com

  • 4608capaydrive.com

  • buckhead-meat.com

  • garage-repair-near-me.com

  • ubique.works

  • markokuzmanovicpreduzetnik.com

Targets

    • Target
      SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184
    • Size 378KB
    • SHA256 5bcba2a09d8758ca07490dfcd3859a64b3a0092ed7873a707e73346eefd4235e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks