Overview

overview

10

Static

static

1

6b26db585f...dd.exe

windows7_x64

10

6b26db585f...dd.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6b26db585f40e14b00b5adda57e595dd.exe
  • Size 200KB
  • Sample210622-drbwqdmhs6
  • SHA256 8b39bf75ce8ca2ecadafeb01a2ff33fc07419198e5b222bf20385ecbf2da0ff4
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.extinctionbrews.com/dy8g/

Decoy

  • mzyxi-rkah-y.net

  • okinawarongnho.com

  • qq66520.com

  • nimbus.watch

  • cwdelrio.com

  • regalshopper.com

  • avito-payment.life

  • jorgeporcayo.com

  • galvinsky.digital

  • guys-only.com

  • asmfruits-almacenes.com

  • boatrace-life04.net

  • cochez.club

  • thelastvictor.net

  • janieleconte.com

  • ivoirepneus.com

  • saludflv.info

  • mydreamtv.net

  • austinphy.com

  • cajunseafoodstcloud.com

Targets

    • Target
      6b26db585f40e14b00b5adda57e595dd.exe
    • Size 200KB
    • SHA256 8b39bf75ce8ca2ecadafeb01a2ff33fc07419198e5b222bf20385ecbf2da0ff4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks