Overview

overview

10

Static

static

5c3e5bb826...9c.exe

windows7_x64

10

5c3e5bb826...9c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5c3e5bb82655b9e9d4c4de37b8261e9c.exe
  • Size 1.0MB
  • Sample211207-py3dashbhk
  • SHA256 ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b
  • MD5 SHA1 SHA512
Score
10/10
xloaderea0rloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ea0r

C2

  • http://www.asiapubz-hk.com/ea0r/

Decoy

  • lionheartcreativestudios.com

  • konzertmanagement.com

  • blackpanther.online

  • broychim-int.com

  • takut18.com

  • txstarsolar.com

  • herdsherpa.com

  • igorshestakov.com

  • shinesbox.com

  • reflectpkljlt.xyz

  • oiltoolshub.com

  • viralmoneychallenge.com

  • changingalphastrategies.com

  • mecitiris.com

  • rdadmin.online

  • miniambiente.com

  • kominarcine.com

  • pino-almond.com

  • heihit.xyz

  • junqi888.com

Targets

    • Target
      5c3e5bb82655b9e9d4c4de37b8261e9c.exe
    • Size 1.0MB
    • SHA256 ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderea0rloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks