Overview

overview

10

Static

static

scan_DHL39382493.exe

windows7_x64

10

scan_DHL39382493.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    scan_DHL39382493.exe
  • Size 705KB
  • Sample210426-2khcyt7b9n
  • SHA256 92db43c3aeae87e9144d896589dc2955fdd60d5bdb8c0f82cce377be0efb8169
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.escape-with-music.com/u2gd/

Decoy

  • dianxiangtechnology.com

  • samarbogast.com

  • primeonlines.com

  • cleanandshineshop.com

  • tenply.com

  • jinpaizs.com

  • yogatona.com

  • theindianbulletin.com

  • elracodeleyton.com

  • thevandolly.com

  • empresadoseculo2020.com

  • discjockeyhammer.com

  • britishgymnasticsclaim.com

  • 1508-324laurier.com

  • reliance-servicess.com

  • ylfxy.com

  • heavenstabetsy.com

  • leahmf.com

  • smartglobalconnect.com

  • papuanewguineaforum.com

Targets

    • Target
      scan_DHL39382493.exe
    • Size 705KB
    • SHA256 92db43c3aeae87e9144d896589dc2955fdd60d5bdb8c0f82cce377be0efb8169
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks