Overview

overview

10

Static

static

35357a041b...18.exe

windows7_x64

10

35357a041b...18.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    35357a041b14cb08b8e107770a9f9c18
  • Size 521KB
  • Sample211124-xjm9tsdebk
  • SHA256 4c6f60ba070864a86dceaa5785b1dceb395cbe4667b9c539bc0675411b4e16a9
  • MD5 SHA1 SHA512
Score
10/10
xloaderhno0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hno0

C2

  • http://www.heidecide.xyz/hno0/

Decoy

  • 526854.rest

  • loosesalatoyof2.xyz

  • drillshear.com

  • kdsh-uae.com

  • firstnetinsurance.net

  • 28684dw.com

  • hikinglifekr.com

  • astramed-clinic.store

  • 24hxinh.com

  • livebongdatv.net

  • henrymaskph.com

  • newlanlan.com

  • txboilerparts.com

  • thepurldistrict.com

  • changemylifefast.info

  • sapphirecloset.com

  • ascensionmemberszoom.com

  • huffmanworks.com

  • techarcstudio.com

  • terbulen.store

Targets

    • Target
      35357a041b14cb08b8e107770a9f9c18
    • Size 521KB
    • SHA256 4c6f60ba070864a86dceaa5785b1dceb395cbe4667b9c539bc0675411b4e16a9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderhno0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks