Overview

overview

10

Static

static

4ebdb80a36...b0.exe

windows7_x64

10

4ebdb80a36...b0.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4ebdb80a36728294c6086c4ed91605b0
  • Size 1.1MB
  • Sample210804-6l9wp941b6
  • SHA256 236348545989c7d1816067f0e7bf78c80d4782e2ac28ab6d9ddbb1a2d4f71cc4
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.mobiessence.com/6mam/

Decoy

  • gxduoke.com

  • lawmetricssolicitors.com

  • e-bizbox.com

  • ilovemehoodie.com

  • marcuslafond.com

  • bransolute.com

  • kuppers.info

  • kykyryky.art

  • vavasoo.com

  • tlamj.com

  • besport24.com

  • hibachiexpressnctogo.com

  • elglink99.com

  • maximos.world

  • uniamaa.com

  • aladinfarma.com

  • opticatervisof.com

  • delhibudokankarate.com

  • juliekifyukstyle.com

  • fuzhourexian.com

Targets

    • Target
      4ebdb80a36728294c6086c4ed91605b0
    • Size 1.1MB
    • SHA256 236348545989c7d1816067f0e7bf78c80d4782e2ac28ab6d9ddbb1a2d4f71cc4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks