Overview

overview

10

Static

static

1

27aa788f99...44.exe

windows7_x64

1

27aa788f99...44.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    27aa788f997fa320003b58fab8a8a244.exe
  • Size 201KB
  • Sample210409-dgv3b222y2
  • SHA256 a086821049463b0bfc414cb3763c4f82688182d2d018ae5c9cd472f59f9e36ff
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.th0rgramm.com/hx3a/

Decoy

  • xn--ol-xia.com

  • gracieleesgiftsandmore.com

  • invenufas.com

  • nexgencoder.com

  • virginiabrightseleccion.com

  • selectenergyservicestx.com

  • warchocki.com

  • xn--comercialvioo-tkb.website

  • losangelesbraiders.com

  • skaraonline.com

  • freeworldsin.com

  • jabberjawmobile.com

  • orgoneartist.com

  • xyfzfl.com

  • arooko.com

  • investmentpartners.limited

  • ugonget.com

  • ringforklift.com

  • recovatek.com

  • bukannyaterbuai24.com

Targets

    • Target
      27aa788f997fa320003b58fab8a8a244.exe
    • Size 201KB
    • SHA256 a086821049463b0bfc414cb3763c4f82688182d2d018ae5c9cd472f59f9e36ff
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks