Overview

overview

10

Static

static

SecuriteIn...43.exe

windows7_x64

10

SecuriteIn...43.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.5562
  • Size 687KB
  • Sample220504-e5c2wadaf6
  • SHA256 06bdc739d26559129afbc157dff8ef0f616dbe885a6cd8a2f43b62efaf848bb9
  • MD5 SHA1 SHA512
Score
10/10
xloadermexqloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mexq

Decoy

  • universopromocionales.info

  • 24-7-solutions.com

  • procofun.com

  • shanghaihuamian.com

  • improvabeauty.com

  • khaulahmuadzah.com

  • turbofonte-montlucon.com

  • yoshii-kuroiwa.com

  • francescaschmeba.com

  • 22142chippewalane.com

  • coalitionloop.com

  • gwsalesllc-cincinnati.com

  • heldennews.online

  • sirius-red.com

  • filegate.cloud

  • finchsales.com

  • bedouindirection.com

  • ktnfilm.xyz

  • chicv-app.xyz

  • kakaqiang.com

Targets

    • Target
      SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.5562
    • Size 687KB
    • SHA256 06bdc739d26559129afbc157dff8ef0f616dbe885a6cd8a2f43b62efaf848bb9
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermexqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks