Overview

overview

10

Static

static

NICHIDEN V...ST.exe

windows7_x64

10

NICHIDEN V...ST.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NICHIDEN VIET NAM - PRODUCTS LIST.exe
  • Size 823KB
  • Sample211119-py4w5adch8
  • SHA256 73b461809cd7295bd5b96d49742acee5ab83f55e774fdc426e7e184bb1fcf097
  • MD5 SHA1 SHA512
Score
10/10
xloaderbus9loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • bus9

C2

  • http://www.navasoft.net/bus9/

Decoy

  • outcheatv.xyz

  • ktnplain.xyz

  • solutionsideas.online

  • partibebas.com

  • blueeng.net

  • immunotecduplicacion.com

  • lovarebtoyof4.xyz

  • dubaibeachluxury.com

  • chernika.group

  • gorgeoussignals.com

  • dxalq.com

  • lj-safe-keepingtoyof6.xyz

  • fluidthinker.com

  • mediafx.store

  • nielsqanalytics.com

  • aabmarketing.com

  • nightpartner96.xyz

  • palisadestahoeresorts.com

  • kanenari0129.com

  • rosekarat.quest

Targets

    • Target
      NICHIDEN VIET NAM - PRODUCTS LIST.exe
    • Size 823KB
    • SHA256 73b461809cd7295bd5b96d49742acee5ab83f55e774fdc426e7e184bb1fcf097
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderbus9loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks