Overview

overview

10

Static

static

1

2T65434568...54.exe

windows7_x64

10

2T65434568...54.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2T65434568--9876543457890-87654.exe
  • Size 338KB
  • Sample210920-m6vbjsdge5
  • SHA256 7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5
  • MD5 SHA1 SHA512
Score
10/10
xloaderdi4cloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.4

Campaign

  • di4c

C2

  • http://www.dropadsmedia.com/di4c/

Decoy

  • oscd.store

  • simplyminiatures.com

  • famouslovebackbaba.com

  • turkesteronesupplement.com

  • most-attractive.com

  • le-thermoplongeur.com

  • joydeb.xyz

  • incomepanther.com

  • infoterkiinii.xyz

  • indigocard.website

  • plasthecnolgy.com

  • canmamap.com

  • aviationtrainingworldusa.com

  • successoffplan.com

  • desert-breeze.com

  • nilavarna.com

  • stanthonyswelfare.com

  • shezefy.com

  • shcq08.xyz

  • spencerpauley.com

Targets

    • Target
      2T65434568--9876543457890-87654.exe
    • Size 338KB
    • SHA256 7811bd14cb7fe9de30afeb44ca4d2f009e0e5f0488ad07f282ad0327b4ecd0b5
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdi4cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks