Overview

overview

10

Static

static

0c54f2f7bc...aa.exe

windows7_x64

10

0c54f2f7bc...aa.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0c54f2f7bca44d750e64872e19f622aa.exe
  • Size 679KB
  • Sample210902-qpj12aaad7
  • SHA256 ee0072bfa491f44ca7379ea10a57c49e384180abf7998f2f4a8b08d4fd24c176
  • MD5 SHA1 SHA512
Score
10/10
xloaderh388loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • h388

C2

  • http://www.innercriticarchetypes.com/h388/

Decoy

  • americangrindstone.com

  • qdy6.club

  • bestsecretrecipes.info

  • 11restoran.com

  • mrhashtags.com

  • theexecutivestudio.com

  • levilatte.com

  • indiantrio.com

  • msdhigh.com

  • spartandiesel.com

  • soccersundays.com

  • eliteworldcars.com

  • superlemon001.com

  • greenlight.school

  • kuryeforum.xyz

  • abc-322.com

  • campbellretreat.com

  • argonmode.net

  • movievilla.info

  • brateix.info

Targets

    • Target
      0c54f2f7bca44d750e64872e19f622aa.exe
    • Size 679KB
    • SHA256 ee0072bfa491f44ca7379ea10a57c49e384180abf7998f2f4a8b08d4fd24c176
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderh388loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks