Overview

overview

10

Static

static

1

SecuriteIn...59.exe

windows7_x64

10

SecuriteIn...59.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.21548.21059

  • Size

    208KB

  • Sample

    210430-yb2dn4yqy6

  • MD5

    e1d2d58d1297d6a7247a37733ed5c211

  • SHA1

    3095d661636ce6b4907d6bcce04e978ca78b3a91

  • SHA256

    3366d2fe9920bad37be4e872bf1cc17af32be4e55828a2efd28e7ebf517253a8

  • SHA512

    3dc9281179aa2f7ec9173d6c6a3068a6a1118891b7e357d2308459ca89469a55d109b37f3f728c473a488fe82f004ac06805198ae779fe8b462a413a6b13401d

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.citestaccnt1597666144.com/ud9e/

Decoy

casezs.com

gascubby.com

pekodains.com

superskosh.com

avktinfracon.com

slink.finance

thegreathopeofearth.com

thebattleofthestars.com

utmxpxq.icu

mamaandbabycleaningservice.com

officialtimelessbeauty.com

keeper.network

leyingcp.com

helpforharrysheroes.com

cohenforleehealthboard.com

wsilhavy.net

logisticsconsultinglimited.com

btechnician.com

dynamicpersiankitten.com

nuplaz.com

Targets

    • Target

      SecuriteInfo.com.W32.AIDetect.malware1.21548.21059

    • Size

      208KB

    • MD5

      e1d2d58d1297d6a7247a37733ed5c211

    • SHA1

      3095d661636ce6b4907d6bcce04e978ca78b3a91

    • SHA256

      3366d2fe9920bad37be4e872bf1cc17af32be4e55828a2efd28e7ebf517253a8

    • SHA512

      3dc9281179aa2f7ec9173d6c6a3068a6a1118891b7e357d2308459ca89469a55d109b37f3f728c473a488fe82f004ac06805198ae779fe8b462a413a6b13401d

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks