Overview

overview

10

Static

static

a2a3dde9af...b7.exe

windows7_x64

10

a2a3dde9af...b7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a2a3dde9afc863ab8254f6a4dbd63eb7
  • Size 351KB
  • Sample211015-j3w47abdeq
  • SHA256 c6bd41deb507046a69d680f7ce7c06ec255fc0ca19223d57788bca61cc14beb9
  • MD5 SHA1 SHA512
Score
10/10
xloaderbs8floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • bs8f

C2

  • http://www.rwilogisticsandbrokerage.com/bs8f/

Decoy

  • vasilnikov.com

  • parkate.club

  • pol360.com

  • handmadequatang.com

  • consult-set.com

  • nourkoki.com

  • theveganfusspot.com

  • dreamssail.com

  • pinpinyouqian.xyz

  • satellitphonestore.com

  • yotosunny.com

  • telosaolympics.com

  • gogetemm.com

  • yozotnpasumo2.xyz

  • avantgardemarket.com

  • glenndcp.com

  • dirtydriverz.com

  • avaui.com

  • anchoredtheblog.com

  • marianaoliveiraarquitetura.com

Targets

    • Target
      a2a3dde9afc863ab8254f6a4dbd63eb7
    • Size 351KB
    • SHA256 c6bd41deb507046a69d680f7ce7c06ec255fc0ca19223d57788bca61cc14beb9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderbs8floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks