Overview

overview

10

Static

static

cea33bbc7a...92.exe

windows7_x64

10

cea33bbc7a...92.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cea33bbc7a347da7c838dd809f672092.exe
  • Size 708KB
  • Sample210606-932dc5p3ps
  • SHA256 f952aa1436789095d76fe6a50ff7ea387aef9751e9b6f0130fcb203040881570
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.aerty.cloud/w88t/

Decoy

  • ios.run

  • jubefa.com

  • ironwooddeervalley.com

  • huttoplumber.com

  • nkd.xyz

  • vivagirlpower.com

  • imhayastan.info

  • tianjinxinghao.com

  • barktothebeach.com

  • morganhertel.com

  • 2linker.com

  • tomrings.com

  • sdx168.com

  • dressusinc.com

  • frontpagesweb.net

  • lotonmyplate.com

  • theballerwhiz.com

  • genrexsys.com

  • jayagunaaluminium.com

  • mubeenmovers.com

Targets

    • Target
      cea33bbc7a347da7c838dd809f672092.exe
    • Size 708KB
    • SHA256 f952aa1436789095d76fe6a50ff7ea387aef9751e9b6f0130fcb203040881570
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks