Overview

overview

10

Static

static

ad0e083604...33.exe

windows7_x64

10

ad0e083604...33.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ad0e083604e877c46c305244b2b4db33.exe
  • Size 557KB
  • Sample210805-d3fdb6skta
  • SHA256 7f3487008181899cb240230130ea395a1b4a925a0fcd216dfdced242e5495deb
  • MD5 SHA1 SHA512
Score
10/10
xloaderatt3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • att3

C2

  • http://www.travelscappadocia.com/att3/

Decoy

  • oakbridgefundservices.com

  • fancyforts.com

  • coisadoce.com

  • learnfrommymentor.com

  • digitalgurughana.com

  • phk0.com

  • jantiprojeekspertiz.com

  • xiabyhuc.com

  • todayonly8.info

  • pgzapgmn.icu

  • sistemasarafranco.com

  • nest-estudio.com

  • 2259.xyz

  • kenobi.tech

  • mortgageloansbyjeff.com

  • thameensa.com

  • navigators.digital

  • ecocleanmalta.com

  • advancedrecyclinginc.com

  • pmotriz.com

Targets

    • Target
      ad0e083604e877c46c305244b2b4db33.exe
    • Size 557KB
    • SHA256 7f3487008181899cb240230130ea395a1b4a925a0fcd216dfdced242e5495deb
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderatt3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks