Overview

overview

10

Static

static

2b0ddd0508...8e.exe

windows7_x64

10

2b0ddd0508...8e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2b0ddd050806aebc7d52fb39a313b08e.exe
  • Size 698KB
  • Sample210419-b27ewxdvse
  • SHA256 c0565af2331df2f4c2b1dd0d96200c21dadb9add0a3e1debaba3b241c38bb3da
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.allindiatrust.com/sbjq/

Decoy

  • topbrandslook.xyz

  • kupilabs.com

  • cedrick.net

  • 91mh.info

  • ajoph.net

  • finishtheverse.com

  • pondokquranaljariyah.com

  • happyhoopoe.com

  • lowcostfooddelivery.com

  • estudiosvacunacovid19-co.com

  • iestradanhhome.com

  • xn--caasymas-e3a.com

  • shopqls.com

  • wpnator.com

  • parentedagency.com

  • nundmshop.com

  • lodosmimarlik.com

  • ccidyy.xyz

  • bem-vestida.com

  • smartincomeafrica.com

Targets

    • Target
      2b0ddd050806aebc7d52fb39a313b08e.exe
    • Size 698KB
    • SHA256 c0565af2331df2f4c2b1dd0d96200c21dadb9add0a3e1debaba3b241c38bb3da
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks