Overview

overview

10

Static

static

70pGP1JaCf6M0kf.exe

windows7_x64

10

70pGP1JaCf6M0kf.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    70pGP1JaCf6M0kf.exe
  • Size 726KB
  • Sample210428-ggpjfexbjs
  • SHA256 be797a9728d2139d4ea71acf7f60816eefc2cb5ec16ce3a366a78f67554d63be
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.hysjs168.com/uv34/

Decoy

  • lattakia-imbiss.com

  • helenafinaltouch.com

  • yogamays.com

  • habangli.com

  • embraceblm.com

  • freeurlsite.com

  • szxanpet.com

  • inspirationalsblog.com

  • calibratefirearms.net

  • chelseashalza.com

  • ihdeuruim.com

  • symbolofsafety.com

  • albanyhumanesociety.net

  • exclusiveoffer.bet

  • 888yuntu.com

  • maraitime.com

  • caletaexperience.com

  • dreamlikeliving.com

  • wolvesmito.club

  • zbyunjin.com

Targets

    • Target
      70pGP1JaCf6M0kf.exe
    • Size 726KB
    • SHA256 be797a9728d2139d4ea71acf7f60816eefc2cb5ec16ce3a366a78f67554d63be
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks