Overview

overview

10

Static

static

1

2394c3a12d...7b.exe

windows7_x64

10

2394c3a12d...7b.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2394c3a12dffc09aede0b0269eaf217b
  • Size 319KB
  • Sample211205-vsjxnafee9
  • SHA256 b3cee8c368d6505d02ba564d72c915341fc782bfa5feda3a1648e448623d6c21
  • MD5 SHA1 SHA512
Score
10/10
xloaderyrcyloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • yrcy

C2

  • http://www.drmichaelirvine.com/yrcy/

Decoy

  • ordermws-brands.com

  • jkbswj.com

  • dairatwsl.com

  • lewismiddleton.com

  • hevenorfeed.com

  • kovogueshop.com

  • cyberitconsultingz.com

  • besrbee.com

  • workerscompfl1.com

  • wayfinderacu.com

  • smplkindness.com

  • servicesitcy.com

  • babyvv.com

  • fly-crypto.com

  • chahuima.com

  • trist-n.tech

  • minjia56.com

  • oded.top

  • mes-dents-blanches.com

  • nethunsleather.com

Targets

    • Target
      2394c3a12dffc09aede0b0269eaf217b
    • Size 319KB
    • SHA256 b3cee8c368d6505d02ba564d72c915341fc782bfa5feda3a1648e448623d6c21
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderyrcyloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks