Overview

overview

10

Static

static

Angebot An...OM.exe

windows7_x64

10

Angebot An...OM.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Angebot Anfrage Maschinensucher YOM.exe
  • Size 559KB
  • Sample211012-trytracgd2
  • SHA256 08040f352684d740d9fa767c3315fb1636394dec01f35abe84ad7116cd735fb4
  • MD5 SHA1 SHA512
Score
10/10
xloaderhu8cloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hu8c

C2

  • http://www.yoruba.loan/hu8c/

Decoy

  • aliceso.photography

  • exploitslozdz.xyz

  • chokefirmbeauty.com

  • sapix-usa.com

  • perfectioncheergym.com

  • igfo.xyz

  • xc6686.com

  • aclproreubensnyder.com

  • xn--bin-2k4mp34c09iwiz.com

  • daumien.com

  • atlanticuniombank.com

  • ookawa.club

  • cherrywoodranchvacationhome.com

  • s6gfec.com

  • ryo-toolset.store

  • talltailfishing.com

  • creativelyaustin.com

  • xn--nqv986be9r.com

  • grpgg2021.space

  • michaelsarcona.com

Targets

    • Target
      Angebot Anfrage Maschinensucher YOM.exe
    • Size 559KB
    • SHA256 08040f352684d740d9fa767c3315fb1636394dec01f35abe84ad7116cd735fb4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderhu8cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks