Overview

overview

10

Static

static

c0225f7670...49.exe

windows7_x64

10

c0225f7670...49.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c0225f76705c05744918c724e3018649.exe
  • Size 540KB
  • Sample211101-lm78maecan
  • SHA256 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c
  • MD5 SHA1 SHA512
Score
10/10
xloadermwevloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mwev

C2

  • http://www.scion-go-getter.com/mwev/

Decoy

  • 9linefarms.com

  • meadow-spring.com

  • texascountrycharts.com

  • chinatowndeliver.com

  • grindsword.com

  • thegurusigavebirthto.com

  • rip-online.com

  • lm-safe-keepingtoyof6.xyz

  • plumbtechconsulting.com

  • jgoerlach.com

  • inbloomsolutions.com

  • foxandmew.com

  • tikomobile.store

  • waybunch.com

  • thepatriottutor.com

  • qask.top

  • pharmacylinked.com

  • ishii-miona.com

  • sugarandrocks.com

  • anabolenpower.net

Targets

    • Target
      c0225f76705c05744918c724e3018649.exe
    • Size 540KB
    • SHA256 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermwevloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks