Overview

overview

10

Static

static

1

459c59759b...9e.exe

windows7_x64

10

459c59759b...9e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    459c59759b4434de04f7bda083ae2a9e.exe
  • Size 213KB
  • Sample210618-9dk4gvf99a
  • SHA256 f4ceea0a1881800f657906368b21c25ebee2c6ac3c7ae210548b1dea0ccd420c
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.meterdraw.com/irux/

Decoy

  • aquaticglobe.com

  • thecomebackcoaches.com

  • eastbaygolflab.com

  • kobetsu-progress.com

  • milletoile.com

  • yourreievolution.com

  • helpsafetycare.com

  • sonetafricasolutions.site

  • webtoleads.com

  • wifarm-urban.com

  • xn--h1aaijq.xn--p1acf

  • clasificadoboricua.com

  • jumhoprivacy.com

  • relax-instant.com

  • anacostiablooms.com

  • tuccishappycandy.com

  • puppiesshops.com

  • yummimarkanni.com

  • plrealestate.net

  • oasismaterials-digital.com

Targets

    • Target
      459c59759b4434de04f7bda083ae2a9e.exe
    • Size 213KB
    • SHA256 f4ceea0a1881800f657906368b21c25ebee2c6ac3c7ae210548b1dea0ccd420c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks