Overview

overview

10

Static

static

PO-003785GMHN.exe

windows7_x64

10

PO-003785GMHN.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO-003785GMHN.exe
  • Size 985KB
  • Sample210927-txj8jshecq
  • SHA256 144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
  • MD5 SHA1 SHA512
Score
10/10
xloader8iwdloaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 8iwd

C2

  • http://www.serpascarnes.com/8iwd/

Decoy

  • openhousedigitale.com

  • helpindia.store

  • josiahspicer.com

  • wydancer.com

  • athinatoday.com

  • asiapartnerspoint.com

  • freemakechefsrecipes.com

  • metrolistingsservices.com

  • assarytagged.quest

  • ververevival.com

  • cjdue.com

  • iqmetaverse.com

  • sh-spgdk.com

  • spacecitybeauty.com

  • phasmatoidea.com

  • yz1866.com

  • tenlog009.xyz

  • gameprizes.xyz

  • 415know.com

  • virus-jestock.com

Targets

    • Target
      PO-003785GMHN.exe
    • Size 985KB
    • SHA256 144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader8iwdloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks