Overview

overview

10

Static

static

1

SecuriteIn...15.exe

windows7_x64

10

SecuriteIn...15.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.NSISX.Spy.Gen.4.25383.8915
  • Size 252KB
  • Sample210924-n7jrwaghb9
  • SHA256 a7acd97fcff334160640901d977010aa55397f5a6da375ab38bcb1622b800f7d
  • MD5 SHA1 SHA512
Score
10/10
xloadernohaloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • noha

C2

  • http://www.mglracing.com/noha/

Decoy

  • iphone13promax.support

  • trailer-racks.xyz

  • overseaspoolservice.com

  • r2d2u.com

  • dawajeju.com

  • nextgenproxyvote.com

  • xn--vhqp8mm8dbtz.group

  • commonsenserisk.com

  • cmcqgxtyd.com

  • data2form.com

  • bois-applique.com

  • originallollipop.com

  • lj0008lj.net

  • spfldvaccineday.info

  • phalcosnusa.com

  • llcmastermachine.com

  • onlyforu14.rest

  • bestmarketingautomations.com

  • officialswitchmusic.com

  • thepretenseofjustice.com

Targets

    • Target
      SecuriteInfo.com.Trojan.NSISX.Spy.Gen.4.25383.8915
    • Size 252KB
    • SHA256 a7acd97fcff334160640901d977010aa55397f5a6da375ab38bcb1622b800f7d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadernohaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks