Overview

overview

10

Static

static

68acef4fe7...17.exe

windows7_x64

10

68acef4fe7...17.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    68acef4fe796ab131edc1f1d9ecb0517.exe
  • Size 1.0MB
  • Sample210827-dda5l9czqa
  • SHA256 35042592e4abe63a3a51543f2cf419f83dee5e2b44bc2d7fe33173fccd10d93a
  • MD5 SHA1 SHA512
Score
10/10
xloaderntheloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • nthe

C2

  • http://www.hanlansmojitovillage.net/nthe/

Decoy

  • omelhorcurso-online.com

  • ttjk020.com

  • urfavvpimp.com

  • touchmytag.com

  • allianzbersamamu.com

  • menucoders.com

  • goldmig.com

  • optplm.com

  • ramblersattic.com

  • thehendrixcollection.com

  • angelsmoonsexshop.com

  • indianajones.club

  • tageslinsen.info

  • thscore2.com

  • onpar-golf.com

  • youcanaskmeto.review

  • overseaexpert.com

  • 1977991.com

  • eurolajd.com

  • thefoxshack.com

Targets

    • Target
      68acef4fe796ab131edc1f1d9ecb0517.exe
    • Size 1.0MB
    • SHA256 35042592e4abe63a3a51543f2cf419f83dee5e2b44bc2d7fe33173fccd10d93a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderntheloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks