Overview

overview

10

Static

static

REQUEST_FO...DF.exe

windows7_x64

10

REQUEST_FO...DF.exe

windows10_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    REQUEST_FOR_QUOTATION_77999_PDF.exe
  • Size 235KB
  • Sample210819-lx8d4b4yce
  • SHA256 179d1cf7266d0149e967f7e6829ed485e3bb73e75ffbce4883111f2595845c85
  • MD5 SHA1 SHA512
Score
10/10
xloadersnaaloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • snaa

C2

  • http://www.xeotochevrolet.com/snaa/

Decoy

  • ivetau.com

  • jupstudios.com

  • myvintagespecs.com

  • nineliveslabs.xyz

  • linahaljarad.com

  • itbling.com

  • bqmmw.com

  • danmgg.com

  • savalanxe.com

  • gasolinestation.info

  • blankedu.com

  • virginiacannabislawyer.com

  • jochichicago.com

  • herbwarts.com

  • bigcitygigs.com

  • gheeduvine.com

  • underwoodway.net

  • philosophia-perennis.club

  • milanodesk.com

  • myrandr.com

Targets

    • Target
      REQUEST_FOR_QUOTATION_77999_PDF.exe
    • Size 235KB
    • SHA256 179d1cf7266d0149e967f7e6829ed485e3bb73e75ffbce4883111f2595845c85
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadersnaaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks