Overview

overview

10

Static

static

b57b573028...dc.exe

windows7_x64

10

b57b573028...dc.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b57b5730286c47c722bd1bd80e22dadc
  • Size 1015KB
  • Sample211209-jgdqqabab3
  • SHA256 87c4a09709a7ba312539673bc4e85e4543d8e1ac4da43ce58adf8635f97f6207
  • MD5 SHA1 SHA512
Score
10/10
xloaderhno0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hno0

C2

  • http://www.heidecide.xyz/hno0/

Decoy

  • 526854.rest

  • loosesalatoyof2.xyz

  • drillshear.com

  • kdsh-uae.com

  • firstnetinsurance.net

  • 28684dw.com

  • hikinglifekr.com

  • astramed-clinic.store

  • 24hxinh.com

  • livebongdatv.net

  • henrymaskph.com

  • newlanlan.com

  • txboilerparts.com

  • thepurldistrict.com

  • changemylifefast.info

  • sapphirecloset.com

  • ascensionmemberszoom.com

  • huffmanworks.com

  • techarcstudio.com

  • terbulen.store

Targets

    • Target
      b57b5730286c47c722bd1bd80e22dadc
    • Size 1015KB
    • SHA256 87c4a09709a7ba312539673bc4e85e4543d8e1ac4da43ce58adf8635f97f6207
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderhno0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks