Overview

overview

10

Static

static

321ebf1c2e...64.exe

windows7_x64

10

321ebf1c2e...64.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    321ebf1c2e57ae454232ee12b6892164.exe

  • Size

    383KB

  • Sample

    210727-fwkqzdxm8a

  • MD5

    321ebf1c2e57ae454232ee12b6892164

  • SHA1

    db9f088a05203a6caf9656e59731f027adfe1bd0

  • SHA256

    3759a4136f3ab450b1c26121511bdfea101baf948b580af60516c8c2d5c7b900

  • SHA512

    afc14c50480f173932da1c0f7d80ef7667eb95a8c8f66279f8481c4ef85a669c8c0ac15582b6762521b78d34af7510c374dd1b30e3fd14e1d273639b4c85e083

Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.extinctionbrews.com/dy8g/

Decoy

mzyxi-rkah-y.net

okinawarongnho.com

qq66520.com

nimbus.watch

cwdelrio.com

regalshopper.com

avito-payment.life

jorgeporcayo.com

galvinsky.digital

guys-only.com

asmfruits-almacenes.com

boatrace-life04.net

cochez.club

thelastvictor.net

janieleconte.com

ivoirepneus.com

saludflv.info

mydreamtv.net

austinphy.com

cajunseafoodstcloud.com

Targets

    • Target

      321ebf1c2e57ae454232ee12b6892164.exe

    • Size

      383KB

    • MD5

      321ebf1c2e57ae454232ee12b6892164

    • SHA1

      db9f088a05203a6caf9656e59731f027adfe1bd0

    • SHA256

      3759a4136f3ab450b1c26121511bdfea101baf948b580af60516c8c2d5c7b900

    • SHA512

      afc14c50480f173932da1c0f7d80ef7667eb95a8c8f66279f8481c4ef85a669c8c0ac15582b6762521b78d34af7510c374dd1b30e3fd14e1d273639b4c85e083

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks