Overview

overview

10

Static

static

9498f1bb75...85.exe

windows7_x64

10

9498f1bb75...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9498f1bb75cd4e894b9a4e701661538900a28585

  • Size

    532KB

  • Sample

    211108-ssksvahdhr

  • MD5

    eb49a3ce053fbb2b9750d682164aea44

  • SHA1

    9498f1bb75cd4e894b9a4e701661538900a28585

  • SHA256

    eb2a7b6be065874a503f985b03be9815553454883b32e19875c3ec5d5dd05fe8

  • SHA512

    97379261fc31f7dbdc1a244b2c41676c31cd12b9cc1c704dfac97548aec15b5f962332d390714d63f729ee4a6b30811c497e14f58646f7ffb70424a4c32d8302

Score
10/10
xloaderpufiloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Targets

    • Target

      9498f1bb75cd4e894b9a4e701661538900a28585

    • Size

      532KB

    • MD5

      eb49a3ce053fbb2b9750d682164aea44

    • SHA1

      9498f1bb75cd4e894b9a4e701661538900a28585

    • SHA256

      eb2a7b6be065874a503f985b03be9815553454883b32e19875c3ec5d5dd05fe8

    • SHA512

      97379261fc31f7dbdc1a244b2c41676c31cd12b9cc1c704dfac97548aec15b5f962332d390714d63f729ee4a6b30811c497e14f58646f7ffb70424a4c32d8302

    Score
    10/10
    xloaderpufiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks