Overview

overview

10

Static

static

5cdf122ace...8b.exe

windows7_x64

10

5cdf122ace...8b.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5cdf122ace2e580ddc241bec6b8b708b.exe
  • Size 821KB
  • Sample210429-2kz8tr54ae
  • SHA256 bc88f7ce08e0f3cd87267fff8188fbdfa3fc9e733db9775d5f06eff82a39a3d6
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.cats16.com/8u3b/

Decoy

  • pipienta.com

  • wisdomfest.net

  • jenniferreich.com

  • bigcanoehomesforless.com

  • kayandbernard.com

  • offerbuildingsecrets.com

  • benleefoto.com

  • contactlesssoftware.tech

  • statenislandplumbing.info

  • lifestylemedicineservices.com

  • blazerplanning.com

  • fnatic-skins.club

  • effectivemarketinginc.com

  • babyshopit.com

  • 2000deal.com

  • k12paymentcemter.com

  • spwakd.com

  • lesreponses.com

  • abundando.com

  • hawkspremierfhc.com

Targets

    • Target
      5cdf122ace2e580ddc241bec6b8b708b.exe
    • Size 821KB
    • SHA256 bc88f7ce08e0f3cd87267fff8188fbdfa3fc9e733db9775d5f06eff82a39a3d6
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks