Overview

overview

10

Static

static

1

2E_PRG_210...df.exe

windows7_x64

10

2E_PRG_210...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2E_PRG_210909_SP-PRG020-21_SHANG_09155231-pdf.exe
  • Size 255KB
  • Sample211027-glwe8aagc8
  • SHA256 f0a7fa8da49f99f47a5e45bfe09792d043a58fb366098ba3aaec126611e0f043
  • MD5 SHA1 SHA512
Score
10/10
xloadero2goloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • o2go

C2

  • http://www.vezmnmnr.xyz/o2go/

Decoy

  • daewon-talks.net

  • sumitgarg.xyz

  • pscresult.info

  • aspireacademy.school

  • centraldoroleplay.com

  • macadamangel.com

  • fanaticscardgroup.com

  • medwives.com

  • madrugachurrosoficial.com

  • expatriatecafe.com

  • k-studio-nekoze.com

  • megmytfgputi.mobi

  • wake-upvmkedz.online

  • af247ccf.com

  • boyle.team

  • helcarpostos.com

  • samusicschool.com

  • mykrema.com

  • sosyalice.net

  • bizz-connects.com

Targets

    • Target
      2E_PRG_210909_SP-PRG020-21_SHANG_09155231-pdf.exe
    • Size 255KB
    • SHA256 f0a7fa8da49f99f47a5e45bfe09792d043a58fb366098ba3aaec126611e0f043
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadero2goloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks