Overview

overview

10

Static

static

15c34e5e1b...d7.exe

windows7_x64

10

15c34e5e1b...d7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15c34e5e1b995ffcbca4310b78f3f7d7

  • Size

    1.2MB

  • Sample

    211210-d9cfgagfcp

  • MD5

    15c34e5e1b995ffcbca4310b78f3f7d7

  • SHA1

    596dbe75dd64288d3b3fc7a29baaf40592ed93d3

  • SHA256

    869a075f9809475dd6839987e3b1431a1fd437ad7879becd35e4f055b4a7f747

  • SHA512

    cc56f17d20e946a19f343da89cb07122009a4db89d50d283498a44161403d9c18c6d93d2849b7f050e63942fcb09af613db233c41f6f1781e397146f363c24b2

Score
10/10
xloaderef6cloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      15c34e5e1b995ffcbca4310b78f3f7d7

    • Size

      1.2MB

    • MD5

      15c34e5e1b995ffcbca4310b78f3f7d7

    • SHA1

      596dbe75dd64288d3b3fc7a29baaf40592ed93d3

    • SHA256

      869a075f9809475dd6839987e3b1431a1fd437ad7879becd35e4f055b4a7f747

    • SHA512

      cc56f17d20e946a19f343da89cb07122009a4db89d50d283498a44161403d9c18c6d93d2849b7f050e63942fcb09af613db233c41f6f1781e397146f363c24b2

    Score
    10/10
    xloaderef6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks