Overview

overview

10

Static

static

PI_OIUYT09...56.exe

windows7_x64

10

PI_OIUYT09...56.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PI_OIUYT0987654456.exe
  • Size 1.2MB
  • Sample210615-dtfar5smfj
  • SHA256 4b6bc079ff664edfcf12f0d33f06e5fcfa98e7b6ac4c33fb5fc3c8c7910aab36
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.bodymoisturizer.online/q4kr/

Decoy

  • realmodapk.com

  • hanoharuka.com

  • shivalikspiritualproducts.com

  • womenshealthclinincagra.com

  • racketpark.com

  • startuporig.com

  • azkachinas.com

  • klanblog.com

  • linuxradio.tools

  • siteoficial-liquida.com

  • glsbuyer.com

  • bestdeez.com

  • teens2cash.com

  • valleyviewconstruct.com

  • myfortniteskins.com

  • cambecare.com

  • csec2011.com

  • idookap.com

  • warmwallsrecords.com

  • smartmirror.one

Targets

    • Target
      PI_OIUYT0987654456.exe
    • Size 1.2MB
    • SHA256 4b6bc079ff664edfcf12f0d33f06e5fcfa98e7b6ac4c33fb5fc3c8c7910aab36
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks