Overview

overview

10

Static

static

1

eaa963442b...f2.exe

windows7_x64

10

eaa963442b...f2.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    eaa963442bab33d032bb5708e34b95f2.exe
  • Size 216KB
  • Sample210615-958j6eb7x2
  • SHA256 cbd8d7c3cf92798b8306074a078a94b84cb49a0db60eafc22d277231a23d7fda
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.oceancollaborative.com/bp3i/

Decoy

  • bancambios.network

  • centroufologicosiciliano.info

  • personalloansonline.xyz

  • xn---yado-8e4dze0c.site

  • americanscientific.net

  • 5australiacl.com

  • sportsiri.com

  • harchain.com

  • oakandivywedding.com

  • getbattlevizion.com

  • laurenamason.com

  • middreampostal.com

  • realityawarenetworks.com

  • purpleqube.com

  • reufhroir.com

  • dr-farshidtajik.com

  • spinecompanion.com

  • grpsexportsandimports.com

  • nodeaths.com

  • indylead.com

Targets

    • Target
      eaa963442bab33d032bb5708e34b95f2.exe
    • Size 216KB
    • SHA256 cbd8d7c3cf92798b8306074a078a94b84cb49a0db60eafc22d277231a23d7fda
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks