Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7_x64

10

SecuriteIn...12.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.PackedNET.1367.10412.32683
  • Size 622KB
  • Sample220606-mydzlabham
  • SHA256 fc753d6a1adb745147ae129b7745f4d5bdb7c02fcad71e96bb40b305ca0b45b8
  • MD5 SHA1 SHA512
Score
10/10
xloadertdhtloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • tdht

Decoy

  • marcosmc.com

  • theknicksfix.com

  • skjgjs.com

  • blacktuxs.com

  • monanimaldecompanie.com

  • initiummallsquare.com

  • bleekvandaag.online

  • ultimatestoragelimited.com

  • caobatins.com

  • sun-mirror.ink

  • eclbet.download

  • kiewitus.com

  • mtgeezer.com

  • sar-partners.com

  • aedregistrations.com

  • hpsebz.online

  • akaxai.com

  • endtoendengineering.com

  • sorayadossantos.com

  • lj2d6dd39.com

Targets

    • Target
      SecuriteInfo.com.Trojan.PackedNET.1367.10412.32683
    • Size 622KB
    • SHA256 fc753d6a1adb745147ae129b7745f4d5bdb7c02fcad71e96bb40b305ca0b45b8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadertdhtloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks