Overview

overview

10

Static

static

Instruction copy.exe

windows7_x64

10

Instruction copy.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Instruction copy.exe

  • Size

    960KB

  • Sample

    210727-t2pbt6k91e

  • MD5

    f91a66d080744b9e8b946984d6d747c4

  • SHA1

    886580b7e7d7f27135d2c9981770a2a59332e680

  • SHA256

    c6a1a1a68b5faac43930deeab9cd6745bde62869786e21e0681b3dc0973afa80

  • SHA512

    b559c9048de556c45f77e26d4c2f1c7785348b76ae4d5f9957e202a5c9d01e7c68a1a3958aeede45ff427ad741b01fcd15497e67898acfc5176f9ac9aa1e2238

Score
10/10
xloaderloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.inverservi.com/m6b5/

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Targets

    • Target

      Instruction copy.exe

    • Size

      960KB

    • MD5

      f91a66d080744b9e8b946984d6d747c4

    • SHA1

      886580b7e7d7f27135d2c9981770a2a59332e680

    • SHA256

      c6a1a1a68b5faac43930deeab9cd6745bde62869786e21e0681b3dc0973afa80

    • SHA512

      b559c9048de556c45f77e26d4c2f1c7785348b76ae4d5f9957e202a5c9d01e7c68a1a3958aeede45ff427ad741b01fcd15497e67898acfc5176f9ac9aa1e2238

    Score
    10/10
    xloaderloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks