Overview

overview

10

Static

static

4b311f7098...f4.exe

windows7_x64

10

4b311f7098...f4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b311f7098e8c26618b8c2c7366282f4

  • Size

    500KB

  • Sample

    211025-s1w6vagch9

  • MD5

    4b311f7098e8c26618b8c2c7366282f4

  • SHA1

    816f73aa214c87fe2704dc8c6a9831f18969ca9b

  • SHA256

    f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a

  • SHA512

    da874e66b92be42ec1d2104fe44d8e09383f6aebb192777c105dbbb5899e6f40a7a851791229ee0bdf9d880af50adfe67d60327c6f6ee22a33b096042affec15

Score
10/10
xloaderpufiloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Targets

    • Target

      4b311f7098e8c26618b8c2c7366282f4

    • Size

      500KB

    • MD5

      4b311f7098e8c26618b8c2c7366282f4

    • SHA1

      816f73aa214c87fe2704dc8c6a9831f18969ca9b

    • SHA256

      f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a

    • SHA512

      da874e66b92be42ec1d2104fe44d8e09383f6aebb192777c105dbbb5899e6f40a7a851791229ee0bdf9d880af50adfe67d60327c6f6ee22a33b096042affec15

    Score
    10/10
    xloaderpufiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks