Overview

overview

10

Static

static

TT Transmi...90.exe

windows7_x64

10

TT Transmi...90.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TT Transmitted Copy TRVTT2200390.exe
  • Size 706KB
  • Sample220112-eynj2abag9
  • SHA256 071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735
  • MD5 SHA1 SHA512
Score
10/10
xloadern8bsloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • n8bs

Decoy

  • monese-bank.com

  • silkypumps.xyz

  • tashabouvier.com

  • eduardoleonsilva.com

  • pinnaclecorporaterentals.com

  • megafluids.com

  • worldwidecarfans.com

  • benjamlnesq.com

  • unitedraxiapp.com

  • thetanheroes.com

  • jypmore.quest

  • indianasheriffs.biz

  • saintinstead.com

  • alldansmx.com

  • trulyproofreading.com

  • indotogel369.com

  • mermadekusse.store

  • radosenterprisellc.com

  • gseequalservices.com

  • techride.xyz

Targets

    • Target
      TT Transmitted Copy TRVTT2200390.exe
    • Size 706KB
    • SHA256 071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern8bsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks