Overview

overview

10

Static

static

f022b6feca...e5.exe

windows7_x64

10

f022b6feca...e5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f022b6feca056d1c00e697fdd3f32ee5
  • Size 841KB
  • Sample211007-wsla6acgc9
  • SHA256 5c175aad872d219fa23de0c83ea085fbdca8d76601167089b4e55ee66d520276
  • MD5 SHA1 SHA512
Score
10/10
xloaderscb0loaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • scb0

C2

  • http://www.llaa11.xyz/scb0/

Decoy

  • austinsv.net

  • nothernballet.com

  • mycoursey.com

  • exodiduis.com

  • frankserranolaw.com

  • dingyiemail.com

  • woodstocktimbersandbeams.com

  • somphones.com

  • goalcations.com

  • boraeresici.com

  • spiegelverwarming.store

  • 8676789.rest

  • tametaverse.com

  • suppliesdevon.com

  • sergiofisheronmcl.com

  • reevophilippines.com

  • oemlift.com

  • helloworld.agency

  • klaydoge.com

  • cristinadiasoficial.com

Targets

    • Target
      f022b6feca056d1c00e697fdd3f32ee5
    • Size 841KB
    • SHA256 5c175aad872d219fa23de0c83ea085fbdca8d76601167089b4e55ee66d520276
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderscb0loaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks