Overview

overview

10

Static

static

REQUEST FO...ON.exe

windows7_x64

10

REQUEST FO...ON.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    REQUEST FOR SPECIFICATION.exe
  • Size 477KB
  • Sample211202-qndsmacaa9
  • SHA256 9e4e02725cde43b4da85cdf054b11ad0e4a622bb54f4a967b1634ebcaea9666a
  • MD5 SHA1 SHA512
Score
10/10
xloaderxgmiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • xgmi

C2

  • http://www.mxnorge.com/xgmi/

Decoy

  • inemilia.com

  • zeuss.info

  • znzv666.com

  • wearablehealthsensor.com

  • 24hservice.online

  • paisabazar.online

  • dqhuanbao.com

  • atalyk.com

  • tzxlkj.com

  • surprisebra.com

  • oometea.com

  • northvisiondigital.com

  • goldenbayexpert.com

  • ricottagomlvr.xyz

  • vjuror.com

  • dudacruz.online

  • mypasscodekeycard.com

  • cameraip.digital

  • rapidtraderfx.com

  • merittanning.com

Targets

    • Target
      REQUEST FOR SPECIFICATION.exe
    • Size 477KB
    • SHA256 9e4e02725cde43b4da85cdf054b11ad0e4a622bb54f4a967b1634ebcaea9666a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderxgmiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks