Overview

overview

10

Static

static

BIN.exe

windows7_x64

10

BIN.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    BIN.exe
  • Size 973KB
  • Sample210826-ejrz3jm9na
  • SHA256 ad2b91ad0e691fd32833926b09af43bcd97a3a231fc53b1effe9b8351da0978f
  • MD5 SHA1 SHA512
Score
10/10
xloadern8baloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • n8ba

C2

  • http://www.narrowpathwc.com/n8ba/

Decoy

  • thefitflect.com

  • anytourist.com

  • blggz.xyz

  • ascope.club

  • obyeboss.com

  • braun-mathematik.online

  • mtsnurulislamsby.com

  • jwpropertiestn.com

  • animalds.com

  • cunerier.com

  • sillysocklife.com

  • shopliyonamaaghin.net

  • theredcymbalsco.com

  • lostbikeproject.com

  • ryggoqlmga.club

  • realestatetriggers.com

  • luvlauricephotography.com

  • cheesehome.cloud

  • 5fashionfix.net

  • wata-6-rwem.net

Targets

    • Target
      BIN.exe
    • Size 973KB
    • SHA256 ad2b91ad0e691fd32833926b09af43bcd97a3a231fc53b1effe9b8351da0978f
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern8baloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks