Overview

overview

10

Static

static

8

SecuriteIn...31.exe

windows7_x64

3

SecuriteIn...31.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetect.malware2.21078.19431
  • Size 361KB
  • Sample210827-3n8knlbeba
  • SHA256 e9714695528eb1f8786fe8a7250f952f23b3205a4e2a60073668717eb2f5dc2b
  • MD5 SHA1 SHA512
Score
10/10
xloaderftgqloaderratupx

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ftgq

C2

  • http://www.mambomakaya.com/ftgq/

Decoy

  • naturalbeautyapparel.com

  • abtotalsolution.com

  • periclescapitalmanagement.com

  • pleasejustdont.com

  • ryanscode.com

  • carsandscooters.com

  • best-polarized-sunglasses.com

  • hoodshawaii.com

  • titaefred.com

  • tomrings.com

  • swededenoting.host

  • birthdaytease.com

  • xaydzn.com

  • scutganxun.com

  • gdzhongle.com

  • alossol.com

  • shivamshield.com

  • fashionnailsjohnston.com

  • jobuelas.com

  • arvopaert.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetect.malware2.21078.19431
    • Size 361KB
    • SHA256 e9714695528eb1f8786fe8a7250f952f23b3205a4e2a60073668717eb2f5dc2b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderftgqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks