Overview

overview

10

Static

static

27e65a2deb...54.exe

windows7_x64

10

27e65a2deb...54.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    27e65a2deb91b09ce02221a4f8ff6954
  • Size 666KB
  • Sample210930-tdya3aabfq
  • SHA256 9cbd20f7dfa4e57fa2adcf34f86c5e2a04b36e346493995d6c9ef85c3960eeb7
  • MD5 SHA1 SHA512
Score
10/10
xloaderscb0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • scb0

C2

  • http://www.vetpipes.com/scb0/

Decoy

  • introlly.com

  • slowtravelco.com

  • sasanos.com

  • 3424soldbastrophwy.com

  • isabelaefernando.net

  • 0754fm.com

  • meta-bot.xyz

  • 778tt8.com

  • krallechols.quest

  • lipagent.com

  • dermaqueeniran.com

  • psychoterapeuta-wroclaw.com

  • marmorariapiramide.online

  • luxonealbery.com

  • floridawp.com

  • nebobuild.com

  • facillitiespro-sweep.com

  • wwgzj.com

  • puffsmoke.online

  • cryptofuelcars.com

Targets

    • Target
      27e65a2deb91b09ce02221a4f8ff6954
    • Size 666KB
    • SHA256 9cbd20f7dfa4e57fa2adcf34f86c5e2a04b36e346493995d6c9ef85c3960eeb7
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderscb0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks