Overview

overview

10

Static

static

NEW ORDER.exe

windows7_x64

10

NEW ORDER.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NEW ORDER.exe
  • Size 509KB
  • Sample210901-jmk95vmcye
  • SHA256 d99804145213694ea4b93c8acb43bf14d712b2043c247c703f88ebc97bf9c8d8
  • MD5 SHA1 SHA512
Score
10/10
xloadern58iloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • n58i

C2

  • http://www.mack3sleeve.com/n58i/

Decoy

  • nl-cafe.com

  • votetedjaleta.com

  • britrobertsrealtor.com

  • globipark.com

  • citysucces.com

  • verisignwebsite-verified.com

  • riddlepc.com

  • rosecityclimbing.com

  • oleandrinextract.com

  • salmankonstruksi.com

  • needhamchannel.com

  • refreshx2z.com

  • youth66.com

  • pla-russia.com

  • halloweenmaskpro.com

  • exdysis.com

  • 1gcz.com

  • lookgoodman.com

  • rlxagva.com

  • stlcityc.com

Targets

    • Target
      NEW ORDER.exe
    • Size 509KB
    • SHA256 d99804145213694ea4b93c8acb43bf14d712b2043c247c703f88ebc97bf9c8d8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern58iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks