Overview

overview

10

Static

static

c50bc8464f...c5.exe

windows7_x64

10

c50bc8464f...c5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c50bc8464f722d1c3e5b33e4ec6de2c5.exe
  • Size 729KB
  • Sample211115-k971psefhk
  • SHA256 b08d103ca391e1023d2b40ac31d0940124e81914eeea79b86c01b7566be546e2
  • MD5 SHA1 SHA512
Score
10/10
xloaderzaiploaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • zaip

C2

  • http://www.madlyrics.net/zaip/

Decoy

  • azxyga.space

  • cahayuu.xyz

  • atapoll.com

  • deadpanrofjvt.xyz

  • mailpostz.com

  • media-mustard.com

  • kondanginyuk.online

  • generatorysolarne.com

  • khayacoffee.com

  • krillnews.com

  • webdyx.com

  • yizongzhongyi.com

  • studiomiden.com

  • weixiaotuo.com

  • padel-ledverlichting.com

  • eastmillnorthandover.com

  • ayhyjj.com

  • hoenirs.info

  • baronbj.com

  • cafesnack.com

Targets

    • Target
      c50bc8464f722d1c3e5b33e4ec6de2c5.exe
    • Size 729KB
    • SHA256 b08d103ca391e1023d2b40ac31d0940124e81914eeea79b86c01b7566be546e2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderzaiploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks