Overview

overview

10

Static

static

notificati...df.exe

windows7_x64

10

notificati...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    [email protected],pdf.exe
  • Size 64KB
  • Sample211022-trclhsbgh8
  • SHA256 dd4af1effdd1081fccbd05d035c4dfac3b992a358e2a6a6140095d0385ca7f5e
  • MD5 SHA1 SHA512
Score
10/10
xloaderg8neloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • g8ne

C2

  • http://www.melindair.xyz/g8ne/

Decoy

  • freesiacreations.com

  • ecopolymer.group

  • ahb9.com

  • ramapuramholdings.com

  • urban-gourmets.com

  • 8xaocu.xyz

  • lancasteremerald.com

  • aktau.group

  • thebeachseekers.com

  • ki5rod.com

  • nmsships.com

  • dppu56.com

  • hairwegoca.net

  • aratakablogz.com

  • staunchgomkdt.xyz

  • leslaw.us

  • restaurantperladelmare.com

  • martensakcio.com

  • motherssecret.store

  • deersolutionsfranchising.com

Targets

    • Target
      [email protected],pdf.exe
    • Size 64KB
    • SHA256 dd4af1effdd1081fccbd05d035c4dfac3b992a358e2a6a6140095d0385ca7f5e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderg8neloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks