Overview

overview

10

Static

static

14f3e43aa2...51.exe

windows7_x64

10

14f3e43aa2...51.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14f3e43aa28d029cc65c39573e41b851
  • Size 477KB
  • Sample211130-s5cyrsfdcl
  • SHA256 a85ee8bb043e9c14cc2a79535f98f674ab0ce2e0fa5d003d1423458df5060996
  • MD5 SHA1 SHA512
Score
10/10
xloader6iknloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 6ikn

C2

  • http://www.ytstocks.com/6ikn/

Decoy

  • hospitaloutpatient.com

  • bestofcrete.info

  • 776756.com

  • himelin.com

  • 360wnn.com

  • hizlikredi.online

  • cacauclubeportugal.com

  • 282btc.art

  • interiorsfurnituredxb.com

  • cachondearais.xyz

  • dey-directory.xyz

  • akiya-saisei.media

  • nsasl.com

  • liacuedu.com

  • careptyltd.com

  • eddiehopkinsonyen.com

  • aunduo.com

  • adrienbphotography.com

  • kupibillet.com

  • bestchoicedentaltotowa.com

Targets

    • Target
      14f3e43aa28d029cc65c39573e41b851
    • Size 477KB
    • SHA256 a85ee8bb043e9c14cc2a79535f98f674ab0ce2e0fa5d003d1423458df5060996
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader6iknloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks