Overview

overview

10

Static

static

8

Proposta n...77.exe

windows7_x64

3

Proposta n...77.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Proposta nº 140689 - Antonio Aurélio dos Santos e Filhos, Lda77.exe
  • Size 361KB
  • Sample210826-bk96hfcd1x
  • SHA256 c46c1d3ce137b855a860af126e8986175501defc0a3f69c5472bf9d905c05bb4
  • MD5 SHA1 SHA512
Score
10/10
xloaderftgqloaderratupx

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ftgq

C2

  • http://www.mambomakaya.com/ftgq/

Decoy

  • naturalbeautyapparel.com

  • abtotalsolution.com

  • periclescapitalmanagement.com

  • pleasejustdont.com

  • ryanscode.com

  • carsandscooters.com

  • best-polarized-sunglasses.com

  • hoodshawaii.com

  • titaefred.com

  • tomrings.com

  • swededenoting.host

  • birthdaytease.com

  • xaydzn.com

  • scutganxun.com

  • gdzhongle.com

  • alossol.com

  • shivamshield.com

  • fashionnailsjohnston.com

  • jobuelas.com

  • arvopaert.com

Targets

    • Target
      Proposta nº 140689 - Antonio Aurélio dos Santos e Filhos, Lda77.exe
    • Size 361KB
    • SHA256 c46c1d3ce137b855a860af126e8986175501defc0a3f69c5472bf9d905c05bb4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderftgqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks