Overview

overview

10

Static

static

SecuriteIn...63.exe

windows7_x64

10

SecuriteIn...63.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Siggen9.56514.26363.23891
  • Size 579KB
  • Sample220603-lnrx2aaaaj
  • SHA256 9f84afaa4d50d08f5034c9301cbb906d5856a4851623c2a6fac93da1acad8ef8
  • MD5 SHA1 SHA512
Score
10/10
xloadera8hqloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • a8hq

Decoy

  • veteransductcleaning.com

  • beajtjunkies.com

  • houseofascofi.com

  • scottsdalemediator.com

  • atelyadesign.com

  • profitcase.pro

  • imtokenio.club

  • qinglingpai.com

  • bigsmile-meal.net

  • daytonlivestream.com

  • aspiradores10.online

  • ytybs120.com

  • hdatelier.com

  • bearpierce.com

  • yeson28ca.com

  • booklearner.com

  • m8j9.club

  • mmophamthinhlegend.space

  • hq4a7o6zb.com

  • sophiadaki.online

Targets

    • Target
      SecuriteInfo.com.Trojan.Siggen9.56514.26363.23891
    • Size 579KB
    • SHA256 9f84afaa4d50d08f5034c9301cbb906d5856a4851623c2a6fac93da1acad8ef8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadera8hqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks