Overview

overview

10

Static

static

f25f99160f...0a.exe

windows7_x64

10

f25f99160f...0a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f25f99160f53de6443616a127637d90a

  • Size

    1.2MB

  • Sample

    211213-yyv4nafdaq

  • MD5

    f25f99160f53de6443616a127637d90a

  • SHA1

    fc2d05b74442ce84eaee52562b74ed85371f0777

  • SHA256

    660fe8ad69670eeba2c95a5a011a8bf98b0effb5398cf1ff6c3a8a759a3bc0c8

  • SHA512

    d3ee70b73a4f37ce0dbce6a81031db7781b7c2f1be6c66dde7c2f94e94752599759e2e8fa66eb2a02b79ff4fcec1cdd971b6ff1fd37955b3796002572fb386e1

Score
10/10
xloaderef6cloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      f25f99160f53de6443616a127637d90a

    • Size

      1.2MB

    • MD5

      f25f99160f53de6443616a127637d90a

    • SHA1

      fc2d05b74442ce84eaee52562b74ed85371f0777

    • SHA256

      660fe8ad69670eeba2c95a5a011a8bf98b0effb5398cf1ff6c3a8a759a3bc0c8

    • SHA512

      d3ee70b73a4f37ce0dbce6a81031db7781b7c2f1be6c66dde7c2f94e94752599759e2e8fa66eb2a02b79ff4fcec1cdd971b6ff1fd37955b3796002572fb386e1

    Score
    10/10
    xloaderef6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks