Overview

overview

10

Static

static

f17ff35403...30.exe

windows7_x64

10

f17ff35403...30.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f17ff35403d075933d203310b3776230.exe
  • Size 459KB
  • Sample211002-tbmfsaedf6
  • SHA256 c8409ef72cffceaf4b66cb2ba74ed66316cf395e1b1ef9014a9024e44ef4136e
  • MD5 SHA1 SHA512
Score
10/10
xloaderscb0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • scb0

C2

  • http://www.vetpipes.com/scb0/

Decoy

  • introlly.com

  • slowtravelco.com

  • sasanos.com

  • 3424soldbastrophwy.com

  • isabelaefernando.net

  • 0754fm.com

  • meta-bot.xyz

  • 778tt8.com

  • krallechols.quest

  • lipagent.com

  • dermaqueeniran.com

  • psychoterapeuta-wroclaw.com

  • marmorariapiramide.online

  • luxonealbery.com

  • floridawp.com

  • nebobuild.com

  • facillitiespro-sweep.com

  • wwgzj.com

  • puffsmoke.online

  • cryptofuelcars.com

Targets

    • Target
      f17ff35403d075933d203310b3776230.exe
    • Size 459KB
    • SHA256 c8409ef72cffceaf4b66cb2ba74ed66316cf395e1b1ef9014a9024e44ef4136e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderscb0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks