Overview

overview

10

Static

static

41a25be792...54.exe

windows7_x64

10

41a25be792...54.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    41a25be792e86680b7a9487f0d31e154.exe
  • Size 242KB
  • Sample210728-hpkfc96456
  • SHA256 ab101d01bcc79b6835eeeae5c3e89b0857fdd3b32e007b15ec5541a5f4aa9e00
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.extinctionbrews.com/dy8g/

Decoy

  • mzyxi-rkah-y.net

  • okinawarongnho.com

  • qq66520.com

  • nimbus.watch

  • cwdelrio.com

  • regalshopper.com

  • avito-payment.life

  • jorgeporcayo.com

  • galvinsky.digital

  • guys-only.com

  • asmfruits-almacenes.com

  • boatrace-life04.net

  • cochez.club

  • thelastvictor.net

  • janieleconte.com

  • ivoirepneus.com

  • saludflv.info

  • mydreamtv.net

  • austinphy.com

  • cajunseafoodstcloud.com

Targets

    • Target
      41a25be792e86680b7a9487f0d31e154.exe
    • Size 242KB
    • SHA256 ab101d01bcc79b6835eeeae5c3e89b0857fdd3b32e007b15ec5541a5f4aa9e00
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks