Overview

overview

10

Static

static

pay.exe

windows7_x64

10

pay.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    pay.exe
  • Size 493KB
  • Sample210915-je915saba2
  • SHA256 7deecd8502e99ced6aec8588840f7e972a3b030c19e0e88ef94ec3a9d2ababc9
  • MD5 SHA1 SHA512
Score
10/10
xloadert75floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.4

Campaign

  • t75f

C2

  • http://www.438451.com/t75f/

Decoy

  • ice-lemon.pro

  • ar3spro.cloud

  • 9055837.com

  • fucksociety.net

  • prettyofficialx.com

  • mfxw.xyz

  • relationshipquiz.info

  • customia.xyz

  • juanayjuan.com

  • zidiankj.com

  • facture-booking.com

  • secondmining.store

  • aboutyou.club

  • gongxichen.com

  • laurabraincreative.com

  • pierrot-bros.com

  • saintpaulaccountingservices.com

  • dom-maya.com

  • garderobamarzen.net

  • la-salamandre-assurances.com

Targets

    • Target
      pay.exe
    • Size 493KB
    • SHA256 7deecd8502e99ced6aec8588840f7e972a3b030c19e0e88ef94ec3a9d2ababc9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadert75floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks