Overview

overview

10

Static

static

investigac...NI.exe

windows7_x64

10

investigac...NI.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    investigaci¢n-URGENTE GRUPO DANI.exe
  • Size 708KB
  • Sample211005-g5g2yahcf2
  • SHA256 73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
  • MD5 SHA1 SHA512
Score
10/10
xloaderb5celoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b5ce

C2

  • http://www.rheilea.com/b5ce/

Decoy

  • advellerd.xyz

  • giasuvina.com

  • arab-xt-pro.com

  • ahsltu2ua4.com

  • trasportesemmanuel.com

  • kissimmeesoccercup.com

  • studyengland.com

  • m2volleyballclub.com

  • shyuehuan.com

  • elsml.com

  • blog-x-history.top

  • coditeu.com

  • allattachments.net

  • vigautruc.com

  • mentication.com

  • zambiaedu.xyz

  • filadelfiacenter.com

  • avlaborsourceinc.info

  • tameka-stewart.com

  • studio-cleo.com

Targets

    • Target
      investigaci¢n-URGENTE GRUPO DANI.exe
    • Size 708KB
    • SHA256 73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb5celoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks