Overview

overview

10

Static

static

1

PURCHASE_O...DF.exe

windows7_x64

10

PURCHASE_O...DF.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PURCHASE_ORDER_QUOTE_08974_PDF.exe
  • Size 335KB
  • Sample210929-k9mprsecg2
  • SHA256 d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2
  • MD5 SHA1 SHA512
Score
10/10
xloaderm6rsloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m6rs

C2

  • http://www.litediv.com/m6rs/

Decoy

  • globalsovereignbank.com

  • ktnrape.xyz

  • churchybulletin.com

  • ddyla.com

  • imatge.cat

  • iwholesalestore.com

  • cultivapro.club

  • ibcfcl.com

  • refurbisheddildo.com

  • killerinktnpasumo4.xyz

  • mdphotoart.com

  • smi-ity.com

  • stanprolearningcenter.com

  • companyintelapp.com

  • tacticarc.com

  • soolls.com

  • gra68.net

  • cedricettori.digital

  • mossobuy.com

  • way2liv.com

Targets

    • Target
      PURCHASE_ORDER_QUOTE_08974_PDF.exe
    • Size 335KB
    • SHA256 d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm6rsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks