Overview

overview

10

Static

static

6ce618034f...41.exe

windows7_x64

10

6ce618034f...41.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6ce618034fc20d32bef9d5210945b941.exe
  • Size 724KB
  • Sample211115-k17nkshga2
  • SHA256 86df15ac78abc1d224a4249db72d29dcb2979fd0669a15c0d291e47648dc0c1c
  • MD5 SHA1 SHA512
Score
10/10
xloaderxgmiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • xgmi

C2

  • http://www.mxnorge.com/xgmi/

Decoy

  • inemilia.com

  • zeuss.info

  • znzv666.com

  • wearablehealthsensor.com

  • 24hservice.online

  • paisabazar.online

  • dqhuanbao.com

  • atalyk.com

  • tzxlkj.com

  • surprisebra.com

  • oometea.com

  • northvisiondigital.com

  • goldenbayexpert.com

  • ricottagomlvr.xyz

  • vjuror.com

  • dudacruz.online

  • mypasscodekeycard.com

  • cameraip.digital

  • rapidtraderfx.com

  • merittanning.com

Targets

    • Target
      6ce618034fc20d32bef9d5210945b941.exe
    • Size 724KB
    • SHA256 86df15ac78abc1d224a4249db72d29dcb2979fd0669a15c0d291e47648dc0c1c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderxgmiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks