Overview

overview

10

Static

static

PO #20004235.exe

windows7_x64

10

PO #20004235.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO #20004235.exe
  • Size 353KB
  • Sample211103-tbmfsaebe9
  • SHA256 73a254fe8cce08216fdd98cfa4c0072ee082d3aae0942b74e6fc0eec2df9df83
  • MD5 SHA1 SHA512
Score
10/10
xloaderefa8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • efa8

C2

  • http://www.viewba.store/efa8/

Decoy

  • novusioux.host

  • keinarosario.info

  • buyvapecart.com

  • departwell.com

  • returnpoint.info

  • ceramic10.com

  • 594121.com

  • billstechadvice.com

  • nakaifans.com

  • mailserver-secure.com

  • percentrostered.net

  • margranmarmoraria.online

  • alwahda.net

  • brightromantic.com

  • gulebic.com

  • legendofmystia.com

  • gamex724.com

  • reuben8.com

  • palisadestahoehousing.com

  • nonthagorn.online

Targets

    • Target
      PO #20004235.exe
    • Size 353KB
    • SHA256 73a254fe8cce08216fdd98cfa4c0072ee082d3aae0942b74e6fc0eec2df9df83
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderefa8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks