Overview

overview

10

Static

static

REVISED_Do...12.exe

windows7_x64

10

REVISED_Do...12.exe

windows10_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    REVISED_Document_NEW_PROJECT-02826626212.exe
  • Size 742KB
  • Sample211125-kmk8esefeq
  • SHA256 d72cdc46d9480840091aa1f842f0e2dd1d44c9b7d6ebf2b8ac8e6491bfcba92c
  • MD5 SHA1 SHA512
Score
10/10
xloader6iknloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 6ikn

C2

  • http://www.ytstocks.com/6ikn/

Decoy

  • hospitaloutpatient.com

  • bestofcrete.info

  • 776756.com

  • himelin.com

  • 360wnn.com

  • hizlikredi.online

  • cacauclubeportugal.com

  • 282btc.art

  • interiorsfurnituredxb.com

  • cachondearais.xyz

  • dey-directory.xyz

  • akiya-saisei.media

  • nsasl.com

  • liacuedu.com

  • careptyltd.com

  • eddiehopkinsonyen.com

  • aunduo.com

  • adrienbphotography.com

  • kupibillet.com

  • bestchoicedentaltotowa.com

Targets

    • Target
      REVISED_Document_NEW_PROJECT-02826626212.exe
    • Size 742KB
    • SHA256 d72cdc46d9480840091aa1f842f0e2dd1d44c9b7d6ebf2b8ac8e6491bfcba92c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader6iknloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks