Overview

overview

10

Static

static

PI-0387991.exe

windows7_x64

10

PI-0387991.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PI-0387991.exe
  • Size 878KB
  • Sample210722-sqsjaj76sa
  • SHA256 8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.bodymoisturizer.online/q4kr/

Decoy

  • realmodapk.com

  • hanoharuka.com

  • shivalikspiritualproducts.com

  • womenshealthclinincagra.com

  • racketpark.com

  • startuporig.com

  • azkachinas.com

  • klanblog.com

  • linuxradio.tools

  • siteoficial-liquida.com

  • glsbuyer.com

  • bestdeez.com

  • teens2cash.com

  • valleyviewconstruct.com

  • myfortniteskins.com

  • cambecare.com

  • csec2011.com

  • idookap.com

  • warmwallsrecords.com

  • smartmirror.one

Targets

    • Target
      PI-0387991.exe
    • Size 878KB
    • SHA256 8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks