Overview

overview

10

Static

static

tmp/reg.exe

windows7_x64

3

tmp/reg.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/reg.exe

  • Size

    406KB

  • Sample

    211202-vesbwadfh6

  • MD5

    192b796d92d190c45204571599c38c86

  • SHA1

    611559df5b74934dea4c81a5490e2c64a73ee6e0

  • SHA256

    23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e

  • SHA512

    da9e4bb2300d2968125427d122d5e81cecf2d342dc2c17fc16d5dc1ac7f511d53e75233c1844c1948f6a82740818166229e7ea2411a40351c54e8e97a3b4ec42

Score
10/10
xloadermwevloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Targets

    • Target

      tmp/reg.exe

    • Size

      406KB

    • MD5

      192b796d92d190c45204571599c38c86

    • SHA1

      611559df5b74934dea4c81a5490e2c64a73ee6e0

    • SHA256

      23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e

    • SHA512

      da9e4bb2300d2968125427d122d5e81cecf2d342dc2c17fc16d5dc1ac7f511d53e75233c1844c1948f6a82740818166229e7ea2411a40351c54e8e97a3b4ec42

    Score
    10/10
    xloadermwevloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks