Overview

overview

10

Static

static

4b318e66b0...68.exe

windows7_x64

10

4b318e66b0...68.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4b318e66b016aa38e7420851c737b268
  • Size 791KB
  • Sample210920-qc8hvsghcn
  • SHA256 fa9bd0ededa6a35bd948c884848855568c1efd4e77bd2ca7786144f81d3f64c5
  • MD5 SHA1 SHA512
Score
10/10
xloadern092loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • n092

C2

  • http://www.awbnmnmammmamnre.top/n092/

Decoy

  • classictilematch.net

  • joy-one.xyz

  • paraflexwork.com

  • eurxtoa.online

  • azrock-express.com

  • rojareal.com

  • weprepareamerica-world.com

  • boss-investor.com

  • sportstrainernetwork.com

  • hoshibanamogurablog.com

  • thymoscorp.com

  • dqrygx.com

  • multispicesindonesia.com

  • fortydaysaesthetic.com

  • citycourtlafayetteclass.com

  • sporexx.com

  • mahsaparvizi.com

  • casinort.net

  • arssaf.com

  • cupandthoughts.com

Targets

    • Target
      4b318e66b016aa38e7420851c737b268
    • Size 791KB
    • SHA256 fa9bd0ededa6a35bd948c884848855568c1efd4e77bd2ca7786144f81d3f64c5
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern092loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks