Overview

overview

10

Static

static

1

196ef716e5...5e.exe

windows7_x64

10

196ef716e5...5e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    196ef716e51eb90f7ffcfd2219ce1d5e.exe
  • Size 253KB
  • Sample210927-kg44cagbf3
  • SHA256 c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb
  • MD5 SHA1 SHA512
Score
10/10
xloaderm0nploaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m0np

C2

  • http://www.devmedicalcentre.com/m0np/

Decoy

  • gruppovimar.com

  • seniordatingtv.com

  • pinpinyouqian.website

  • retreatreflectreplenish.com

  • baby-handmade.store

  • econsupplies.com

  • helloaustinpodcast.com

  • europe-lodging.com

  • ferahanaokulu.com

  • thehomeinspo.com

  • rawhoneytnpasumo6.xyz

  • tyckasei.quest

  • scissorsandbuffer.com

  • jatinvestmentsmaldives.com

  • softandcute.store

  • afuturemakerspromotions.online

  • leonsigntech.com

  • havetheshortscovered.com

  • cvkf.email

  • iplyyu.com

Targets

    • Target
      196ef716e51eb90f7ffcfd2219ce1d5e.exe
    • Size 253KB
    • SHA256 c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm0nploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks