Overview

overview

10

Static

static

tmp/femvv.exe

windows7_x64

10

tmp/femvv.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/femvv.exe

  • Size

    412KB

  • Sample

    211215-l8r4jahcd7

  • MD5

    0843bc912b1a4b9a4f41be4fb5f5b3ed

  • SHA1

    68c8657051a0bb979d0c1db69be0488b844f391f

  • SHA256

    777c86a17146921e06f4ac7ab01da50e0e3fa657160bcd49e8c99c63f3bf4de4

  • SHA512

    aaf2031984e113c4c179b7de211dec159c89b0b758f1869f5d19576188989c1b5fc26c96ffcb2cecbcc6be32c9b2f6f916ca55a05bfc9fecd99bb4a5094d203f

Score
10/10
xloaderef6cloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      tmp/femvv.exe

    • Size

      412KB

    • MD5

      0843bc912b1a4b9a4f41be4fb5f5b3ed

    • SHA1

      68c8657051a0bb979d0c1db69be0488b844f391f

    • SHA256

      777c86a17146921e06f4ac7ab01da50e0e3fa657160bcd49e8c99c63f3bf4de4

    • SHA512

      aaf2031984e113c4c179b7de211dec159c89b0b758f1869f5d19576188989c1b5fc26c96ffcb2cecbcc6be32c9b2f6f916ca55a05bfc9fecd99bb4a5094d203f

    Score
    10/10
    xloaderef6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks