Overview

overview

10

Static

static

e91117a646...4c.exe

windows7_x64

10

e91117a646...4c.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e91117a64646a3362796ec445df5ca4c.exe
  • Size 964KB
  • Sample220322-xgcejsgff2
  • SHA256 cd8517b48008d82b4246f4fa0dee41f6510127486f8c1e24293174c794f35684
  • MD5 SHA1 SHA512
Score
10/10
xloaderdgrgloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • dgrg

Decoy

  • iot-vn.com

  • gamiteisnowjoyned.com

  • ak8flfqzm8.com

  • daliborkokic.com

  • mrk-9.com

  • tanzibkarate.quest

  • mburmtdvccti.mobi

  • thomas-wildlife-control.com

  • thebritenseries.com

  • hkkbags.com

  • redenyl.com

  • resilientbutterfly.com

  • nicethelab.com

  • xn--1lq90isray30ltdc.xn--czru2d

  • cyberews.net

  • naclepin2a.xyz

  • rodrigocoppa.com

  • hightings.com

  • chamaaibrasil.com

  • bdelsaer.com

Targets

    • Target
      e91117a64646a3362796ec445df5ca4c.exe
    • Size 964KB
    • SHA256 cd8517b48008d82b4246f4fa0dee41f6510127486f8c1e24293174c794f35684
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdgrgloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks