Overview

overview

10

Static

static

1

9a687ace43...f6.exe

windows7_x64

10

9a687ace43...f6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9a687ace431a49705adbcd7bfbbddcf6.exe
  • Size 201KB
  • Sample210409-ksqef999qs
  • SHA256 4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.zlzntiayc.icu/a6ru/

Decoy

  • noseainsight.com

  • chateaudedigoine.com

  • tezhonda.com

  • lowergwyeneddmassage.com

  • convenienttext.com

  • quickbookaccountingpros.com

  • mashburneventcenter.com

  • marthabymsfashion.com

  • thearcadela.com

  • invisiblefingerprint.com

  • nikadoo.com

  • artsmartclinton.com

  • elitetouringinnovations.com

  • atualizarapp2020.com

  • nideke1.com

  • fyj-sh.com

  • rufflesales.com

  • algemixdelchef.com

  • appleoneplus.com

  • ryosuketanikawa.com

Targets

    • Target
      9a687ace431a49705adbcd7bfbbddcf6.exe
    • Size 201KB
    • SHA256 4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks