Overview

overview

10

Static

static

f705807259...85.exe

windows7_x64

10

f705807259...85.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f7058072591bbc7032cc0daedbccbf85
  • Size 452KB
  • Sample211111-nhp8csgcfk
  • SHA256 433494d21eabe777d1947da83d6281e5ac35bf98eea4791fcebf5e1561723384
  • MD5 SHA1 SHA512
Score
10/10
xloaderfpdiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • fpdi

C2

  • http://www.walletwriter.space/fpdi/

Decoy

  • jencio.com

  • b9jty7.com

  • banahinvestments.com

  • capitolfurniture.net

  • jlvip1086.com

  • pompeyocargo.com

  • designbyshubhi.info

  • elbauldepecas.com

  • bracelexx.online

  • advanceporbrx.xyz

  • ruihongco.com

  • wipemirecord.com

  • goodfoodsme.com

  • sommpick.com

  • rangilugujarat.com

  • realestate5g.com

  • spunkdlashes.com

  • palisadestahoehousing.com

  • brandingsocal.com

  • privatejetsboston.com

Targets

    • Target
      f7058072591bbc7032cc0daedbccbf85
    • Size 452KB
    • SHA256 433494d21eabe777d1947da83d6281e5ac35bf98eea4791fcebf5e1561723384
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderfpdiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks