Overview

overview

10

Static

static

SecuriteIn...82.exe

windows7_x64

10

SecuriteIn...82.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.Win32.Save.a.4961.31882

  • Size

    376KB

  • Sample

    211020-ll38aagha4

  • MD5

    4b48b5446900ebee9d709a961c053003

  • SHA1

    4a68ff9efea5f6f072e9ad8f7bf1611d381b24b5

  • SHA256

    36465b5c8b0baa57cc7d26405d290bff57488f216c72654b2773e506dc6646df

  • SHA512

    d58291cd1a08c9ea1b1d59fb8cd93e3a5372cb12ef202b4e4629c08e58557bc9d4322b9cc2843d5d13a8ee4486239de4b200e87c0503a506b0f6e77c823fb489

Score
10/10
xloaderfqiqloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

C2

http://www.esyscoloradosprings.com/fqiq/

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

    • Target

      SecuriteInfo.com.Trojan.Win32.Save.a.4961.31882

    • Size

      376KB

    • MD5

      4b48b5446900ebee9d709a961c053003

    • SHA1

      4a68ff9efea5f6f072e9ad8f7bf1611d381b24b5

    • SHA256

      36465b5c8b0baa57cc7d26405d290bff57488f216c72654b2773e506dc6646df

    • SHA512

      d58291cd1a08c9ea1b1d59fb8cd93e3a5372cb12ef202b4e4629c08e58557bc9d4322b9cc2843d5d13a8ee4486239de4b200e87c0503a506b0f6e77c823fb489

    Score
    10/10
    xloaderfqiqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks