Overview

overview

10

Static

static

eab193344b...1b.exe

windows7_x64

10

eab193344b...1b.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    eab193344b506b1507675779ebf8c11b
  • Size 796KB
  • Sample210804-rsty6qg566
  • SHA256 39e07d983dda2437d04b37965671e84be2116f882c7c3a689ed137c8e2a1e10a
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.gaigoilaocai.com/wufn/

Decoy

  • rsautoluxe.com

  • theroseofsharonsalon.com

  • singnema.com

  • nathanielwhite108.com

  • theforumonline.com

  • iqpt.info

  • joneshondaservice.com

  • fafene.com

  • solanohomebuyerclass.com

  • zwq.xyz

  • searchlakeconroehomes.com

  • briative.com

  • frystmor.city

  • systemofyouth.com

  • sctsmney.com

  • tv-safetrading.com

  • thesweetboy.com

  • occulusblu.com

  • pawsthemomentpetphotography.com

  • travelstipsguide.com

Targets

    • Target
      eab193344b506b1507675779ebf8c11b
    • Size 796KB
    • SHA256 39e07d983dda2437d04b37965671e84be2116f882c7c3a689ed137c8e2a1e10a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks