Overview

overview

10

Static

static

c18d17e306...35.exe

windows7_x64

1

c18d17e306...35.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c18d17e306f88680c41675f7d72ede35.exe

  • Size

    1.3MB

  • Sample

    211214-va4jcagbb9

  • MD5

    c18d17e306f88680c41675f7d72ede35

  • SHA1

    96954aa52f0faf7cab05b1977cad58dd65850c9a

  • SHA256

    69713f8848927ec48d76fa26b2c64741b98ecfd7356a023e7bd5f2b193edc480

  • SHA512

    3d9950b2467042205d43ea6d391864a8c1a3f3cdedc8c0e1e89ac3abfe7a9974f50a0cdf0956e9e42a07a4bf50a6009cf09823e9a047db67363f91fc9397d091

Score
10/10
xloaderef6cloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      c18d17e306f88680c41675f7d72ede35.exe

    • Size

      1.3MB

    • MD5

      c18d17e306f88680c41675f7d72ede35

    • SHA1

      96954aa52f0faf7cab05b1977cad58dd65850c9a

    • SHA256

      69713f8848927ec48d76fa26b2c64741b98ecfd7356a023e7bd5f2b193edc480

    • SHA512

      3d9950b2467042205d43ea6d391864a8c1a3f3cdedc8c0e1e89ac3abfe7a9974f50a0cdf0956e9e42a07a4bf50a6009cf09823e9a047db67363f91fc9397d091

    Score
    10/10
    xloaderef6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks