Overview

overview

10

Static

static

10

oooo.exe

windows7_x64

5

oooo.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    oooo

  • Size

    164KB

  • Sample

    211021-lhbnvsaah5

  • MD5

    33f851f65f6b0b30c69cc8c113079565

  • SHA1

    a6dec10d7b33bf25d351f1d1a6ada52cbb7dcaf2

  • SHA256

    ee30bcf64cc2b2664a526d9bf03da79d2bcb3b9633783621642fcf3b5aecebd3

  • SHA512

    c4f323feadc237965cabd2ad2b33187ad120f32071b7dbd89d6e65e0cce7a3e7f9e8fa8d10923383d9dcd582238194a775bc59ec6a2cdfaf73a7c453d6ad23df

Score
10/10
xloadermexqloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mexq

C2

http://www.aliexpress-br.com/mexq/

Decoy

cyebang.com

hcswwsz.com

50003008.com

yfly624.xyz

trungtamhohap.xyz

sotlbb.com

bizhan69.com

brandmty.net

fucibou.xyz

orderinformantmailer.store

nobleminers.com

divinevoid.com

quickappraisal.net

adventuretravelsworld.com

ashainitiativemp.com

ikkbs-a02.com

rd26x.com

goraeda.com

abbastanza.info

andypartridge.photography

Targets

    • Target

      oooo

    • Size

      164KB

    • MD5

      33f851f65f6b0b30c69cc8c113079565

    • SHA1

      a6dec10d7b33bf25d351f1d1a6ada52cbb7dcaf2

    • SHA256

      ee30bcf64cc2b2664a526d9bf03da79d2bcb3b9633783621642fcf3b5aecebd3

    • SHA512

      c4f323feadc237965cabd2ad2b33187ad120f32071b7dbd89d6e65e0cce7a3e7f9e8fa8d10923383d9dcd582238194a775bc59ec6a2cdfaf73a7c453d6ad23df

    Score
    10/10
    xloadermexqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks