Overview

overview

10

Static

static

c4839f9e9d...e6.exe

windows7_x64

10

c4839f9e9d...e6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c4839f9e9d80100927eb39678175bbe6
  • Size 816KB
  • Sample211117-sqrhlsabar
  • SHA256 945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a
  • MD5 SHA1 SHA512
Score
10/10
xloadermwevloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mwev

C2

  • http://www.scion-go-getter.com/mwev/

Decoy

  • 9linefarms.com

  • meadow-spring.com

  • texascountrycharts.com

  • chinatowndeliver.com

  • grindsword.com

  • thegurusigavebirthto.com

  • rip-online.com

  • lm-safe-keepingtoyof6.xyz

  • plumbtechconsulting.com

  • jgoerlach.com

  • inbloomsolutions.com

  • foxandmew.com

  • tikomobile.store

  • waybunch.com

  • thepatriottutor.com

  • qask.top

  • pharmacylinked.com

  • ishii-miona.com

  • sugarandrocks.com

  • anabolenpower.net

Targets

    • Target
      c4839f9e9d80100927eb39678175bbe6
    • Size 816KB
    • SHA256 945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermwevloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks