Overview

overview

10

Static

static

1

f86c2fb3c0...bf.exe

windows7_x64

10

f86c2fb3c0...bf.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f86c2fb3c00fe61bd8b09a8fdad039bf.exe
  • Size 517KB
  • Sample211206-qrtm9aebbr
  • SHA256 8ddb1b007d499a165554e933dcfb0ce8a7ced3506f2609c2a5225c64755bb69a
  • MD5 SHA1 SHA512
Score
10/10
xloaderhf9jloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hf9j

C2

  • http://www.dubaibiologicdentist.com/hf9j/

Decoy

  • afrifarmgroup.com

  • coffeeassiciation.com

  • unlimit-ed.com

  • guy.rest

  • dnemperor.com

  • ringstorule.com

  • reelnasty.com

  • travelgleam.com

  • sagestyleresale.com

  • jiaoyizhuan.club

  • fastred.biz

  • xn--fiqs8srv0ahj5a.xn--czru2d

  • eden-foundation.com

  • exquisite-epoxy-systems.com

  • luxurycaroffer.com

  • sdffzc.com

  • suvsdealsonlinesearchdusorg.com

  • weihaits.com

  • fetch-us-mtg-refi.zone

  • uterinevmkvhm.online

Targets

    • Target
      f86c2fb3c00fe61bd8b09a8fdad039bf.exe
    • Size 517KB
    • SHA256 8ddb1b007d499a165554e933dcfb0ce8a7ced3506f2609c2a5225c64755bb69a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderhf9jloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks