Overview

overview

10

Static

static

9cdc6fca89...a7.exe

windows7_x64

10

9cdc6fca89...a7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9cdc6fca894d41cc415e6810793212a7.exe
  • Size 604KB
  • Sample211103-x17d2aeeh8
  • SHA256 e1f8c7d02c06ad8a4d9a2e46a9c9d73e8cb95c854ca4c0558ae8c83e11f8c63b
  • MD5 SHA1 SHA512
Score
10/10
xloadersywuloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • sywu

C2

  • http://www.interrstellar.xyz/sywu/

Decoy

  • odfj.top

  • ceracareofficial.top

  • 38leckiestreet.com

  • minibustaxiservice.com

  • juliorodriguez.info

  • bslol.tech

  • tequesquitengomorelos.com

  • xiaye.tech

  • retamedia.com

  • ppaltobk.com

  • patriciaavalos.com

  • williejfrink.com

  • registrarmilhas.online

  • quotexromania.com

  • 78923iox.com

  • thesavingsplaceforseniors.com

  • earth-lights.net

  • theconnectedforests.com

  • danziki.info

  • tripleincome.trade

Targets

    • Target
      9cdc6fca894d41cc415e6810793212a7.exe
    • Size 604KB
    • SHA256 e1f8c7d02c06ad8a4d9a2e46a9c9d73e8cb95c854ca4c0558ae8c83e11f8c63b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadersywuloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks