Overview

overview

10

Static

static

000987654345XASD.exe

windows7_x64

10

000987654345XASD.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    000987654345XASD.exe
  • Size 922KB
  • Sample210604-1af2jpep2e
  • SHA256 087cdc5835abffd34e9db443da4632ba71f58573e0d1d140aabadf6f773e8df4
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.bodymoisturizer.online/q4kr/

Decoy

  • realmodapk.com

  • hanoharuka.com

  • shivalikspiritualproducts.com

  • womenshealthclinincagra.com

  • racketpark.com

  • startuporig.com

  • azkachinas.com

  • klanblog.com

  • linuxradio.tools

  • siteoficial-liquida.com

  • glsbuyer.com

  • bestdeez.com

  • teens2cash.com

  • valleyviewconstruct.com

  • myfortniteskins.com

  • cambecare.com

  • csec2011.com

  • idookap.com

  • warmwallsrecords.com

  • smartmirror.one

Targets

    • Target
      000987654345XASD.exe
    • Size 922KB
    • SHA256 087cdc5835abffd34e9db443da4632ba71f58573e0d1d140aabadf6f773e8df4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks