Overview

overview

10

Static

static

b04b0416c7...a7.exe

windows7_x64

10

b04b0416c7...a7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b04b0416c7a562416e58c07fb38699a7.exe
  • Size 699KB
  • Sample211004-tpm98sgfc6
  • SHA256 19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2
  • MD5 SHA1 SHA512
Score
10/10
xloaderscb0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • scb0

C2

  • http://www.vetpipes.com/scb0/

Decoy

  • introlly.com

  • slowtravelco.com

  • sasanos.com

  • 3424soldbastrophwy.com

  • isabelaefernando.net

  • 0754fm.com

  • meta-bot.xyz

  • 778tt8.com

  • krallechols.quest

  • lipagent.com

  • dermaqueeniran.com

  • psychoterapeuta-wroclaw.com

  • marmorariapiramide.online

  • luxonealbery.com

  • floridawp.com

  • nebobuild.com

  • facillitiespro-sweep.com

  • wwgzj.com

  • puffsmoke.online

  • cryptofuelcars.com

Targets

    • Target
      b04b0416c7a562416e58c07fb38699a7.exe
    • Size 699KB
    • SHA256 19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderscb0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks