Overview

overview

10

Static

static

2b12e8bec8...17.exe

windows7_x64

10

2b12e8bec8...17.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2b12e8bec8e8469f62fd8469f5a8f417.exe
  • Size 356KB
  • Sample211104-v3p7esecdp
  • SHA256 77582ba5bb0a7e0894a64d832ead70cd8572cb49f21fcdc10d8904d68343798d
  • MD5 SHA1 SHA512
Score
10/10
xloaderbs8floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • bs8f

C2

  • http://www.rwilogisticsandbrokerage.com/bs8f/

Decoy

  • vasilnikov.com

  • parkate.club

  • pol360.com

  • handmadequatang.com

  • consult-set.com

  • nourkoki.com

  • theveganfusspot.com

  • dreamssail.com

  • pinpinyouqian.xyz

  • satellitphonestore.com

  • yotosunny.com

  • telosaolympics.com

  • gogetemm.com

  • yozotnpasumo2.xyz

  • avantgardemarket.com

  • glenndcp.com

  • dirtydriverz.com

  • avaui.com

  • anchoredtheblog.com

  • marianaoliveiraarquitetura.com

Targets

    • Target
      2b12e8bec8e8469f62fd8469f5a8f417.exe
    • Size 356KB
    • SHA256 77582ba5bb0a7e0894a64d832ead70cd8572cb49f21fcdc10d8904d68343798d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderbs8floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks