Overview

overview

10

Static

static

1C7mNWnoqzhRHKC.exe

windows7_x64

10

1C7mNWnoqzhRHKC.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1C7mNWnoqzhRHKC.exe
  • Size 930KB
  • Sample220314-k56xvaeac8
  • SHA256 e321bd433e6e630bb69b21c80533446717274fd02eb74e74670934f5cc7e145c
  • MD5 SHA1 SHA512
Score
10/10
xloaderh85eloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • h85e

Decoy

  • escvillage.com

  • planetacarballo.com

  • alexandercaron.com

  • yeslic.com

  • muckymitts.com

  • constructionsdhblais.com

  • 1iheuz.cloud

  • jonathanandlola.info

  • quantumweave.com

  • flippingmetro.com

  • ledytj.com

  • tender.guru

  • icatercookouts.com

  • liegeart.com

  • ibizaeyewear.com

  • micrkindom.com

  • sorialab8.online

  • spiritueleonlinetraining.online

  • teguhbestari.com

  • areservice.center

Targets

    • Target
      1C7mNWnoqzhRHKC.exe
    • Size 930KB
    • SHA256 e321bd433e6e630bb69b21c80533446717274fd02eb74e74670934f5cc7e145c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderh85eloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks