Overview

overview

10

Static

static

Request fo...on.exe

windows7_x64

10

Request fo...on.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Request for Quotation.exe
  • Size 505KB
  • Sample211027-g2m4saagf5
  • SHA256 19bc9a34f4a074428bec1c81bb731aab86b38d877dca82ecae158f9b29d93dbf
  • MD5 SHA1 SHA512
Score
10/10
xloaderb2c0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b2c0

C2

  • http://www.thesewhitevvalls.com/b2c0/

Decoy

  • bjyxszd520.xyz

  • hsvfingerprinting.com

  • elliotpioneer.com

  • bf396.com

  • chinaopedia.com

  • 6233v.com

  • shopeuphoricapparel.com

  • loccssol.store

  • truefictionpictures.com

  • playstarexch.com

  • peruviancoffee.store

  • shobhajoshi.com

  • philme.net

  • avito-rules.com

  • independencehomecenters.com

  • atp-cayenne.com

  • invetorsbank.com

  • sasanos.com

  • scentfreebnb.com

  • catfuid.com

Targets

    • Target
      Request for Quotation.exe
    • Size 505KB
    • SHA256 19bc9a34f4a074428bec1c81bb731aab86b38d877dca82ecae158f9b29d93dbf
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb2c0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks