Overview

overview

10

Static

static

412241a931...a6.exe

windows7_x64

10

412241a931...a6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    412241a9318ff1dac966423d98e42ca6
  • Size 443KB
  • Sample211113-m1ph4sehg3
  • SHA256 b4c8ee0de2b2db7adf56e9cbe744b5737b6efe3c3b851bfab64b1690dca0d5ca
  • MD5 SHA1 SHA512
Score
10/10
xloaderscb0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • scb0

C2

  • http://www.llaa11.xyz/scb0/

Decoy

  • austinsv.net

  • nothernballet.com

  • mycoursey.com

  • exodiduis.com

  • frankserranolaw.com

  • dingyiemail.com

  • woodstocktimbersandbeams.com

  • somphones.com

  • goalcations.com

  • boraeresici.com

  • spiegelverwarming.store

  • 8676789.rest

  • tametaverse.com

  • suppliesdevon.com

  • sergiofisheronmcl.com

  • reevophilippines.com

  • oemlift.com

  • helloworld.agency

  • klaydoge.com

  • cristinadiasoficial.com

Targets

    • Target
      412241a9318ff1dac966423d98e42ca6
    • Size 443KB
    • SHA256 b4c8ee0de2b2db7adf56e9cbe744b5737b6efe3c3b851bfab64b1690dca0d5ca
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderscb0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks