Overview

overview

10

Static

static

1

463112a011...de.exe

windows7_x64

10

463112a011...de.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    463112a0111bd29c88fc7f47d5747cde
  • Size 466KB
  • Sample211126-nsw4nafdd2
  • SHA256 55cb62507ca0a059b4ccd73090352bc2ca8aef120a329787a3b635a679b6dff8
  • MD5 SHA1 SHA512
Score
10/10
xloaderhf9jloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hf9j

C2

  • http://www.dubaibiologicdentist.com/hf9j/

Decoy

  • afrifarmgroup.com

  • coffeeassiciation.com

  • unlimit-ed.com

  • guy.rest

  • dnemperor.com

  • ringstorule.com

  • reelnasty.com

  • travelgleam.com

  • sagestyleresale.com

  • jiaoyizhuan.club

  • fastred.biz

  • xn--fiqs8srv0ahj5a.xn--czru2d

  • eden-foundation.com

  • exquisite-epoxy-systems.com

  • luxurycaroffer.com

  • sdffzc.com

  • suvsdealsonlinesearchdusorg.com

  • weihaits.com

  • fetch-us-mtg-refi.zone

  • uterinevmkvhm.online

Targets

    • Target
      463112a0111bd29c88fc7f47d5747cde
    • Size 466KB
    • SHA256 55cb62507ca0a059b4ccd73090352bc2ca8aef120a329787a3b635a679b6dff8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderhf9jloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks