Overview

overview

10

Static

static

SOA.exe

windows7_x64

10

SOA.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SOA.exe
  • Size 695KB
  • Sample210830-a2d98n378j
  • SHA256 d6fa87fb59dbf4de1d1d0af1062a41e6a9620b682ecdfc0eb91856e28b9ea1de
  • MD5 SHA1 SHA512
Score
10/10
xloaderb6culoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • b6cu

C2

  • http://www.xn--marketingrevolucin-61b.com/b6cu/

Decoy

  • votreconseilfinancier.com

  • wholesaleplay.com

  • komfy.store

  • hsyunfan.com

  • tournamenttips.com

  • yourbusine.xyz

  • wrg-referrals.com

  • harmless-oily.com

  • whizdomtowealth.com

  • xusmods.com

  • cleanerstoday.com

  • finopscert.com

  • paerexpress.com

  • kankb.com

  • res-o.info

  • balonpantolon.com

  • freedownloadbiz.info

  • jeffegriffin.com

  • gobahis119.com

  • ourcalvinsarm.com

Targets

    • Target
      SOA.exe
    • Size 695KB
    • SHA256 d6fa87fb59dbf4de1d1d0af1062a41e6a9620b682ecdfc0eb91856e28b9ea1de
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb6culoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks