Overview

overview

10

Static

static

SecuriteIn...32.exe

windows7_x64

10

SecuriteIn...32.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetect.malware1.17659.21832
  • Size 364KB
  • Sample210412-2h85351wee
  • SHA256 f36d0fe551b2be41e023f6a55d35ffb3ae7a5e021703c4b49235e04e296aceb3
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.scott-re.online/nnmd/

Decoy

  • bongwater.life

  • regalparkllc.com

  • gyanankuram.com

  • quehaydecenarhoy.com

  • israeldigitalblog.net

  • gatewaygaurdians.com

  • krphp.com

  • domentemenegi47.com

  • fjsibao.com

  • yetbor.com

  • goldenvalueable.com

  • finalexam-thegame.com

  • buyeverythingforbaby.com

  • phillydroneservices.com

  • xn--kck4cd0r.net

  • suns-brothers.com

  • xn--80aaxkmix.xn--p1acf

  • pjsgsc.com

  • 7985699.com

  • blackmantech.fitness

Targets

    • Target
      SecuriteInfo.com.W32.AIDetect.malware1.17659.21832
    • Size 364KB
    • SHA256 f36d0fe551b2be41e023f6a55d35ffb3ae7a5e021703c4b49235e04e296aceb3
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks