Overview

overview

10

Static

static

1

fb6c841478...ff.exe

windows7_x64

10

fb6c841478...ff.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fb6c841478354f42dd2baa5e0b617dff.exe
  • Size 207KB
  • Sample210503-gp1tg7vt8a
  • SHA256 b55552391ee123f26e577b412c0df78bd0a59644ec510d1e7e708feff12a2abb
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.montcoimmigrationlawyer.com/uoe8/

Decoy

  • chalance.design

  • certifiedlaywernj.com

  • bsbgraphic.com

  • caeka.com

  • zagorafinancial.com

  • cvingenieriacivil.net

  • mojilifenoosa.com

  • bucktheherd.net

  • sparkmonic.com

  • catherineandwilson.com

  • cdefenders.com

  • intersp.net

  • santoriniimpressivetours.net

  • arkansaspaymentrelief.com

  • tewab.com

  • bjzjgjg.com

  • michgoliki.com

  • oallahplease.com

  • plaisterpress.com

  • redyroblx.com

Targets

    • Target
      fb6c841478354f42dd2baa5e0b617dff.exe
    • Size 207KB
    • SHA256 b55552391ee123f26e577b412c0df78bd0a59644ec510d1e7e708feff12a2abb
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks