Overview

overview

10

Static

static

SMC Req Of...df.exe

windows7_x64

10

SMC Req Of...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SMC Req Offer 06079681 pdf.exe
  • Size 1.0MB
  • Sample210720-16edba4bdj
  • SHA256 dfe19acb83c53bf3fd25bea127cf728c9140cf48d6a55e51b76cef0e92a03d1c
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.innercriticarchetypes.com/h388/

Decoy

  • americangrindstone.com

  • qdy6.club

  • bestsecretrecipes.info

  • 11restoran.com

  • mrhashtags.com

  • theexecutivestudio.com

  • levilatte.com

  • indiantrio.com

  • msdhigh.com

  • spartandiesel.com

  • soccersundays.com

  • eliteworldcars.com

  • superlemon001.com

  • greenlight.school

  • kuryeforum.xyz

  • abc-322.com

  • campbellretreat.com

  • argonmode.net

  • movievilla.info

  • brateix.info

Targets

    • Target
      SMC Req Offer 06079681 pdf.exe
    • Size 1.0MB
    • SHA256 dfe19acb83c53bf3fd25bea127cf728c9140cf48d6a55e51b76cef0e92a03d1c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks