Overview

overview

10

Static

static

SecuriteIn...01.exe

windows7_x64

10

SecuriteIn...01.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Strictor.262459.22102.23101
  • Size 511KB
  • Sample211129-e5zkwabegr
  • SHA256 864492d660b1978cc4b0ceb1008c334704d049cb77f98ddf8179660c7f2125cd
  • MD5 SHA1 SHA512
Score
10/10
xloaderea0rloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ea0r

C2

  • http://www.asiapubz-hk.com/ea0r/

Decoy

  • lionheartcreativestudios.com

  • konzertmanagement.com

  • blackpanther.online

  • broychim-int.com

  • takut18.com

  • txstarsolar.com

  • herdsherpa.com

  • igorshestakov.com

  • shinesbox.com

  • reflectpkljlt.xyz

  • oiltoolshub.com

  • viralmoneychallenge.com

  • changingalphastrategies.com

  • mecitiris.com

  • rdadmin.online

  • miniambiente.com

  • kominarcine.com

  • pino-almond.com

  • heihit.xyz

  • junqi888.com

Targets

    • Target
      SecuriteInfo.com.Variant.Strictor.262459.22102.23101
    • Size 511KB
    • SHA256 864492d660b1978cc4b0ceb1008c334704d049cb77f98ddf8179660c7f2125cd
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderea0rloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks