Overview

overview

10

Static

static

SecuriteIn...50.exe

windows7_x64

10

SecuriteIn...50.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.1159.2750.2520
  • Size 585KB
  • Sample220528-avmfcaade5
  • SHA256 075f41c576c8e20d1ec1981a5e4197d514030c69dd653dfc2b94edf5088a0671
  • MD5 SHA1 SHA512
Score
10/10
xloadercrqploaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • crqp

Decoy

  • ftepenrollmyrhbenefit.com

  • maecharlie.com

  • probaganda.com

  • nightclubmontcada.com

  • giapsychic.com

  • hexinchao.com

  • lifelovely.site

  • magiaphotoshop.com

  • taurusafr7o.com

  • loen6.com

  • 7drnpc.com

  • caramelshubs.com

  • witiboss.com

  • marketablesecuritycourses.com

  • sunflowerkreationsllc.com

  • bantuancs24jam.com

  • simplecleaningcompany.com

  • fdjzx.com

  • whatdoesxstandfor.com

  • reliableworldnews.net

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.1159.2750.2520
    • Size 585KB
    • SHA256 075f41c576c8e20d1ec1981a5e4197d514030c69dd653dfc2b94edf5088a0671
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadercrqploaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks