Overview

overview

10

Static

static

SecuriteIn...30.exe

windows7_x64

10

SecuriteIn...30.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Scr.Malcodegdn30.31730.22946
  • Size 476KB
  • Sample220330-r5vm5sdaa4
  • SHA256 d6ee29c576a6f06612430d000f2f72fd64df7763a982acf42e72f4bcd4665c3a
  • MD5 SHA1 SHA512
Score
10/10
xloaderp89mloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p89m

Decoy

  • wrapapplausechutney.xyz

  • covidmobiletestingmd.com

  • convey.gifts

  • b148tlrfee9evtvorgm5947.com

  • zmlhtjfls.com

  • mctrumpthyism.com

  • lilaixi.store

  • interstatehardwarenj.com

  • horakokode.com

  • 42wilsonavenue.com

  • muskanphysio.com

  • absoluteuniquecrafts.store

  • donategame.online

  • greenlinkengineering.net

  • pinchanzosloyalty.com

  • companyintel.network

  • resumewriterguru.com

  • oakalleyatcimarron.com

  • sriyawealthplan.com

  • mpcollection.online

Targets

    • Target
      SecuriteInfo.com.Scr.Malcodegdn30.31730.22946
    • Size 476KB
    • SHA256 d6ee29c576a6f06612430d000f2f72fd64df7763a982acf42e72f4bcd4665c3a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp89mloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks