Overview

overview

10

Static

static

REMITTANCE COPY.exe

windows7_x64

1

REMITTANCE COPY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REMITTANCE COPY.exe

  • Size

    1.3MB

  • Sample

    210920-f8v8asdaf3

  • MD5

    01b0dffa7c000f4d55544eb38f8ab238

  • SHA1

    cfa6ae5441f0c41d5d92e0fab0eb90b44e0d621e

  • SHA256

    f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594

  • SHA512

    d55c5d8e942d5dfe74a4ece63b707fa2a6f5d8551ed268d08eab9258ab9d91371d13a2dd447eb860b71bcbb125d5a1948b61bf40a2b7321dde7d6d2ce83cb526

Score
10/10
xloaderc2ueloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Targets

    • Target

      REMITTANCE COPY.exe

    • Size

      1.3MB

    • MD5

      01b0dffa7c000f4d55544eb38f8ab238

    • SHA1

      cfa6ae5441f0c41d5d92e0fab0eb90b44e0d621e

    • SHA256

      f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594

    • SHA512

      d55c5d8e942d5dfe74a4ece63b707fa2a6f5d8551ed268d08eab9258ab9d91371d13a2dd447eb860b71bcbb125d5a1948b61bf40a2b7321dde7d6d2ce83cb526

    Score
    10/10
    xloaderc2ueloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks