Overview

overview

10

Static

static

1

VSL_MV SEA...RS.exe

windows7_x64

10

VSL_MV SEA...RS.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    VSL_MV SEA-BLUE SHIP OWNERS.exe
  • Size 288KB
  • Sample211123-b3kr6acce2
  • SHA256 2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c
  • MD5 SHA1 SHA512
Score
10/10
xloadere8ialoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • e8ia

C2

  • http://www.helpfromjames.com/e8ia/

Decoy

  • le-hameau-enchanteur.com

  • quantumsystem-au.club

  • engravedeeply.com

  • yesrecompensas.lat

  • cavallitowerofficials.com

  • 800seaspray.com

  • skifun-jetski.com

  • thouartafoot.com

  • nft2dollar.com

  • petrestore.online

  • cjcutthecord2.com

  • tippimccullough.com

  • gadget198.xyz

  • djmiriam.com

  • bitbasepay.com

  • cukierniawz.com

  • mcclureic.xyz

  • inthekitchenshakinandbakin.com

  • busy-clicks.com

  • melaniemorris.online

Targets

    • Target
      VSL_MV SEA-BLUE SHIP OWNERS.exe
    • Size 288KB
    • SHA256 2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadere8ialoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks