Overview

overview

10

Static

static

1

13f0e4473f...cd.exe

windows7_x64

10

13f0e4473f...cd.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    13f0e4473fcb6056df19f29a6dac2acd.exe
  • Size 191KB
  • Sample210713-yvtj2crcwe
  • SHA256 0cf80c8f64e7d607ee9088aaae888815ef75788f4f425b8fed868f0b057abdee
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.extinctionbrews.com/dy8g/

Decoy

  • mzyxi-rkah-y.net

  • okinawarongnho.com

  • qq66520.com

  • nimbus.watch

  • cwdelrio.com

  • regalshopper.com

  • avito-payment.life

  • jorgeporcayo.com

  • galvinsky.digital

  • guys-only.com

  • asmfruits-almacenes.com

  • boatrace-life04.net

  • cochez.club

  • thelastvictor.net

  • janieleconte.com

  • ivoirepneus.com

  • saludflv.info

  • mydreamtv.net

  • austinphy.com

  • cajunseafoodstcloud.com

Targets

    • Target
      13f0e4473fcb6056df19f29a6dac2acd.exe
    • Size 191KB
    • SHA256 0cf80c8f64e7d607ee9088aaae888815ef75788f4f425b8fed868f0b057abdee
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks