Overview

overview

10

Static

static

SecuriteIn...13.exe

windows7_x64

10

SecuriteIn...13.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.1113.29739
  • Size 649KB
  • Sample220525-1fbneaddf2
  • SHA256 eebc2ceadb7e9541112a27a583603fd284208f1e2d23329c726efcfc02244609
  • MD5 SHA1 SHA512
Score
10/10
xloadertn61loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • tn61

Decoy

  • ryliehorrall.art

  • mesdco.net

  • street-art-ink.com

  • sepetcin.com

  • stilghar.com

  • hawaiipooltiles.com

  • fuerst-von-falkennest.com

  • totalvirtue.com

  • xdk0blc0tqy6a7.life

  • zootowngravel.com

  • kreditkarten-optionde.com

  • 6888tlbb.xyz

  • albertakleekai.com

  • travelnurseinfofinder3.life

  • valleyinnswat.com

  • secure-remove-devices.com

  • digitalswamy.com

  • www112casinova.com

  • medifasttrd.com

  • distritoxermar.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.1113.29739
    • Size 649KB
    • SHA256 eebc2ceadb7e9541112a27a583603fd284208f1e2d23329c726efcfc02244609
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadertn61loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks