Overview

overview

10

Static

static

f670d4f350...1d.exe

windows7_x64

10

f670d4f350...1d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f670d4f35079acdbb5e7c5b58286ad1d.exe

  • Size

    1.5MB

  • Sample

    211207-p6ebfacbe9

  • MD5

    f670d4f35079acdbb5e7c5b58286ad1d

  • SHA1

    ebcd6560c27e98d643fe48deb2e1758cb39a4212

  • SHA256

    a5980948bb83834c850b21ed35bf1ed3d324b4c85f86b82a4e540aeb399eb1e8

  • SHA512

    443092ad2c709d871beb41dbcb6e25ba0c320fa08f25ce15ad89dbbc5ef8c0e3ae25ea2309406e3e65fed02f5ef7fc463e945620ee9edbcbeea6d0dfb2c70cc8

Score
10/10
xloaderef6cloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      f670d4f35079acdbb5e7c5b58286ad1d.exe

    • Size

      1.5MB

    • MD5

      f670d4f35079acdbb5e7c5b58286ad1d

    • SHA1

      ebcd6560c27e98d643fe48deb2e1758cb39a4212

    • SHA256

      a5980948bb83834c850b21ed35bf1ed3d324b4c85f86b82a4e540aeb399eb1e8

    • SHA512

      443092ad2c709d871beb41dbcb6e25ba0c320fa08f25ce15ad89dbbc5ef8c0e3ae25ea2309406e3e65fed02f5ef7fc463e945620ee9edbcbeea6d0dfb2c70cc8

    Score
    10/10
    xloaderef6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks