Overview

overview

10

Static

static

1

716f61cba6...a0.exe

windows7_x64

10

716f61cba6...a0.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    716f61cba6d08cd0c1904bcc827b56a0.exe
  • Size 207KB
  • Sample210503-v3cv2q1f3s
  • SHA256 2833ffeca48c46759cb0d4c984e81a9b69614c368bf0052600786e55fd534d67
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.stonescapes1.com/de92/

Decoy

  • zindaginews.com

  • tyelevator.com

  • schustermaninterests.com

  • algemixdelchef.com

  • doubscollectivites.com

  • e-butchery.com

  • hellbentmask.com

  • jumbpprivacy.com

  • teeniestiedye.com

  • playfulartwork.com

  • desertvacahs.com

  • w5470-hed.net

  • nepalearningpods.com

  • smoothandsleek.com

  • thecannaglow.com

  • torrentkittyla.com

  • industrytoyou.com

  • raquelvargas.net

  • rlc-nc.net

  • cryptoprises.com

Targets

    • Target
      716f61cba6d08cd0c1904bcc827b56a0.exe
    • Size 207KB
    • SHA256 2833ffeca48c46759cb0d4c984e81a9b69614c368bf0052600786e55fd534d67
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks