Overview

overview

10

Static

static

PO202104-1...df.exe

windows7_x64

10

PO202104-1...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO202104-114 - APQ Comercial Apoquindo,pdf.exe
  • Size 628KB
  • Sample211112-j5ktyachc5
  • SHA256 3040f22b6d5519be09fd6bcf5865d095cefa7f19e0d55f24b7975885e50239a2
  • MD5 SHA1 SHA512
Score
10/10
xloaderb62nloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b62n

C2

  • http://www.multidetoxhepatico.com/b62n/

Decoy

  • childzplanet.com

  • nine8culture.com

  • yourfoodmenu.com

  • nxhxyzjy.com

  • nobelies.com

  • baetsupreme.net

  • indiadiscountedfares.com

  • iconnect-design.com

  • durston.store

  • sweetcreationsbyjp.com

  • ktieman.com

  • getvirtualaddress.com

  • cryptopoly-figures.com

  • minismi2.com

  • ricemoment.com

  • regionalhomescommercial.com

  • onelike.biz

  • d22.group

  • kwissleapp.com

  • cindyrandband.com

Targets

    • Target
      PO202104-114 - APQ Comercial Apoquindo,pdf.exe
    • Size 628KB
    • SHA256 3040f22b6d5519be09fd6bcf5865d095cefa7f19e0d55f24b7975885e50239a2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb62nloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks