Overview

overview

10

Static

static

00098765456ERTT.exe

windows7_x64

10

00098765456ERTT.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    00098765456ERTT.exe
  • Size 914KB
  • Sample210818-1kelc1rl52
  • SHA256 c8eaf61ec06ca57d311161006408fa0bfbe4d22e89c07c5b6b3ccc029c26ae69
  • MD5 SHA1 SHA512
Score
10/10
xloaderq4krloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • q4kr

C2

  • http://www.bodymoisturizer.online/q4kr/

Decoy

  • realmodapk.com

  • hanoharuka.com

  • shivalikspiritualproducts.com

  • womenshealthclinincagra.com

  • racketpark.com

  • startuporig.com

  • azkachinas.com

  • klanblog.com

  • linuxradio.tools

  • siteoficial-liquida.com

  • glsbuyer.com

  • bestdeez.com

  • teens2cash.com

  • valleyviewconstruct.com

  • myfortniteskins.com

  • cambecare.com

  • csec2011.com

  • idookap.com

  • warmwallsrecords.com

  • smartmirror.one

Targets

    • Target
      00098765456ERTT.exe
    • Size 914KB
    • SHA256 c8eaf61ec06ca57d311161006408fa0bfbe4d22e89c07c5b6b3ccc029c26ae69
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderq4krloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks