Overview

overview

10

Static

static

R2P78YZdvFH5ZJh.exe

windows7_x64

10

R2P78YZdvFH5ZJh.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    R2P78YZdvFH5ZJh.exe
  • Size 775KB
  • Sample210920-nk1f4sdhd2
  • SHA256 6acf1bec87a9b06a63ac3be623a527d7c419d17bb8a258b67e2f7cc2c607cc10
  • MD5 SHA1 SHA512
Score
10/10
xloadergjehloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • gjeh

C2

  • http://www.getaudionow.com/gjeh/

Decoy

  • carmator.com

  • bsbqrp.com

  • siemens-mp.com

  • dunnfloorcoverings.com

  • cpassminimedicalschools.info

  • howtodesignyourhomeoffice.com

  • famliytaste.com

  • freesocialmarketing.com

  • jejuhaenyeo.net

  • tradebot.icu

  • arzug.com

  • carrefour-solucoes.online

  • ladyom.com

  • aoironote.com

  • newmexicocarwreckattorney.com

  • wealthpatternsllc.net

  • thinkpinkalicous.com

  • prajapati.company

  • bjhwky.com

  • jsdigitalekuns.com

Targets

    • Target
      R2P78YZdvFH5ZJh.exe
    • Size 775KB
    • SHA256 6acf1bec87a9b06a63ac3be623a527d7c419d17bb8a258b67e2f7cc2c607cc10
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadergjehloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks