Overview

overview

10

Static

static

1

SecuriteIn...20.exe

windows7_x64

10

SecuriteIn...20.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.UDS.Trojan-Spy.Win32.Noon.gen.25193.5020
  • Size 320KB
  • Sample210519-dfxt2kv99n
  • SHA256 1265cd7cd52561d0e688f2ea1a8a9c8ed712b4f6fb82e253424f9a6cdad5d995
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.cozinhablog.com/cu6s/

Decoy

  • leclog.com

  • theratlife.com

  • fsboomaha.com

  • levelsautoltd.com

  • bigfacecoffees.com

  • longhornmath.com

  • tacomawageneralcontractor.com

  • 999-fortune.com

  • alohamg.com

  • aecenteringsheets.com

  • stmconstructlonllc.com

  • allmountaininstitute.com

  • ramirezvirtualsolutions.com

  • surviveandthrivelife.com

  • endaride.com

  • sugarguest.com

  • okeymodels.com

  • finecutbutcher.com

  • moorerepsinstructure.com

  • redingardensh.com

Targets

    • Target
      SecuriteInfo.com.UDS.Trojan-Spy.Win32.Noon.gen.25193.5020
    • Size 320KB
    • SHA256 1265cd7cd52561d0e688f2ea1a8a9c8ed712b4f6fb82e253424f9a6cdad5d995
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks