Overview

overview

10

Static

static

192b796d92...86.exe

windows7_x64

3

192b796d92...86.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    192b796d92d190c45204571599c38c86
  • Size 406KB
  • Sample211202-xlc7msbcer
  • SHA256 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e
  • MD5 SHA1 SHA512
Score
10/10
xloadermwevloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mwev

C2

  • http://www.scion-go-getter.com/mwev/

Decoy

  • 9linefarms.com

  • meadow-spring.com

  • texascountrycharts.com

  • chinatowndeliver.com

  • grindsword.com

  • thegurusigavebirthto.com

  • rip-online.com

  • lm-safe-keepingtoyof6.xyz

  • plumbtechconsulting.com

  • jgoerlach.com

  • inbloomsolutions.com

  • foxandmew.com

  • tikomobile.store

  • waybunch.com

  • thepatriottutor.com

  • qask.top

  • pharmacylinked.com

  • ishii-miona.com

  • sugarandrocks.com

  • anabolenpower.net

Targets

    • Target
      192b796d92d190c45204571599c38c86
    • Size 406KB
    • SHA256 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermwevloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks