Overview

overview

10

Static

static

1ac9a083e0...6e.exe

windows7_x64

3

1ac9a083e0...6e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1ac9a083e02365f726ee1e704ef5386e
  • Size 548KB
  • Sample211203-wfrbmscag5
  • SHA256 409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28
  • MD5 SHA1 SHA512
Score
10/10
xloadermwevloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mwev

C2

  • http://www.scion-go-getter.com/mwev/

Decoy

  • 9linefarms.com

  • meadow-spring.com

  • texascountrycharts.com

  • chinatowndeliver.com

  • grindsword.com

  • thegurusigavebirthto.com

  • rip-online.com

  • lm-safe-keepingtoyof6.xyz

  • plumbtechconsulting.com

  • jgoerlach.com

  • inbloomsolutions.com

  • foxandmew.com

  • tikomobile.store

  • waybunch.com

  • thepatriottutor.com

  • qask.top

  • pharmacylinked.com

  • ishii-miona.com

  • sugarandrocks.com

  • anabolenpower.net

Targets

    • Target
      1ac9a083e02365f726ee1e704ef5386e
    • Size 548KB
    • SHA256 409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermwevloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks