Overview

overview

10

Static

static

1

P.O.exe

windows7_x64

10

P.O.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P.O.exe

  • Size

    207KB

  • Sample

    210505-k3r5sd7psa

  • MD5

    eb71efe60cabc2d6aa9a49a82a4ded77

  • SHA1

    c188402835e985adac142eee6e0b31fd4c0c0ae6

  • SHA256

    9b70fcd07ba7d3dcef17f3b28cf75e304840a67e8611dc149744215f8483066d

  • SHA512

    3654b1ff3b57ca883b6fc6d086a8c90654f3e59f2efbe7341677ac85216bc8c1d2bc448940081eb9852f10f43a51d71f4eeef05445e046b9726108f792bdc1c2

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Targets

    • Target

      P.O.exe

    • Size

      207KB

    • MD5

      eb71efe60cabc2d6aa9a49a82a4ded77

    • SHA1

      c188402835e985adac142eee6e0b31fd4c0c0ae6

    • SHA256

      9b70fcd07ba7d3dcef17f3b28cf75e304840a67e8611dc149744215f8483066d

    • SHA512

      3654b1ff3b57ca883b6fc6d086a8c90654f3e59f2efbe7341677ac85216bc8c1d2bc448940081eb9852f10f43a51d71f4eeef05445e046b9726108f792bdc1c2

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks