Overview

overview

10

Static

static

14e865f28f...f9.exe

windows7_x64

10

14e865f28f...f9.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14e865f28f1a02890383d2ec6638e6f9
  • Size 1017KB
  • Sample211215-n7116aadem
  • SHA256 6fafca0825dbdedf739d4f57ea1b09563eed9834a54f2998b712891baeef4839
  • MD5 SHA1 SHA512
Score
10/10
xloaderb62nloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b62n

C2

  • http://www.multidetoxhepatico.com/b62n/

Decoy

  • childzplanet.com

  • nine8culture.com

  • yourfoodmenu.com

  • nxhxyzjy.com

  • nobelies.com

  • baetsupreme.net

  • indiadiscountedfares.com

  • iconnect-design.com

  • durston.store

  • sweetcreationsbyjp.com

  • ktieman.com

  • getvirtualaddress.com

  • cryptopoly-figures.com

  • minismi2.com

  • ricemoment.com

  • regionalhomescommercial.com

  • onelike.biz

  • d22.group

  • kwissleapp.com

  • cindyrandband.com

Targets

    • Target
      14e865f28f1a02890383d2ec6638e6f9
    • Size 1017KB
    • SHA256 6fafca0825dbdedf739d4f57ea1b09563eed9834a54f2998b712891baeef4839
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb62nloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks