Overview

overview

10

Static

static

SOA & INV ...21.exe

windows7_x64

10

SOA & INV ...21.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SOA & INV FOR OCT'21.exe
  • Size 426KB
  • Sample211109-p73enafce5
  • SHA256 696ba6fed0994cac4e47993f336820499cd3faf3ce4713d4e0be0ea0d91748af
  • MD5 SHA1 SHA512
Score
10/10
xloaderu0n0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u0n0

C2

  • http://www.52xjg3.xyz/u0n0/

Decoy

  • learnwithvr.net

  • minismi2.com

  • slimfitbottle.com

  • gzartisan.com

  • fullfamilyclub.com

  • adaptationstudios.com

  • domynt.com

  • aboydnfuid.com

  • dirtroaddesigns.net

  • timhortons-ca.xyz

  • gladiator-111.com

  • breakingza.com

  • njjbds.com

  • keithrgordon.com

  • litestore365.host

  • unichromegame.com

  • wundversorgung-tirol.com

  • wholistic-choice.com

  • shingletownrrn.com

  • kapikenya.com

Targets

    • Target
      SOA & INV FOR OCT'21.exe
    • Size 426KB
    • SHA256 696ba6fed0994cac4e47993f336820499cd3faf3ce4713d4e0be0ea0d91748af
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu0n0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks