Overview

overview

10

Static

static

T39209.exe

windows7_x64

10

T39209.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    T39209.exe
  • Size 540KB
  • Sample211102-2w85aacgc2
  • SHA256 77a0d2b3cf7736f6ba6798b004ce89ce2cbbd049a8eaef6bec53cc854b4e79c9
  • MD5 SHA1 SHA512
Score
10/10
xloadergnuiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • gnui

C2

  • http://www.hottorchlighter.com/gnui/

Decoy

  • himalayanwanderwoods.com

  • finvi.guru

  • iphone13promax.show

  • rpfcomunicacao.com

  • inemilia.com

  • blboutiqueexchange.com

  • sukiller.com

  • tzwa.net

  • noemiklein.com

  • upscalepklptp.xyz

  • unboxk.com

  • greatamericanlandworks.com

  • bataperu.com

  • estebanacostapeugeot.com

  • gombc-a02.com

  • 642541.com

  • 13f465.com

  • jskswj.com

  • hibar.xyz

  • eltool.net

Targets

    • Target
      T39209.exe
    • Size 540KB
    • SHA256 77a0d2b3cf7736f6ba6798b004ce89ce2cbbd049a8eaef6bec53cc854b4e79c9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadergnuiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks