Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7_x64

10

SecuriteIn...22.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.999.22645.5322
  • Size 837KB
  • Sample210823-srnbbgl23x
  • SHA256 52aaa20eef4d75bb209ef1d632a3e5a894358ebbd5ae9e18262868209fa30b7c
  • MD5 SHA1 SHA512
Score
10/10
xloaderb6culoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • b6cu

C2

  • http://www.xn--marketingrevolucin-61b.com/b6cu/

Decoy

  • votreconseilfinancier.com

  • wholesaleplay.com

  • komfy.store

  • hsyunfan.com

  • tournamenttips.com

  • yourbusine.xyz

  • wrg-referrals.com

  • harmless-oily.com

  • whizdomtowealth.com

  • xusmods.com

  • cleanerstoday.com

  • finopscert.com

  • paerexpress.com

  • kankb.com

  • res-o.info

  • balonpantolon.com

  • freedownloadbiz.info

  • jeffegriffin.com

  • gobahis119.com

  • ourcalvinsarm.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.999.22645.5322
    • Size 837KB
    • SHA256 52aaa20eef4d75bb209ef1d632a3e5a894358ebbd5ae9e18262868209fa30b7c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb6culoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks