Overview

overview

10

Static

static

SecuriteIn...19.exe

windows7_x64

10

SecuriteIn...19.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.16119.3116
  • Size 449KB
  • Sample220613-vb9fzshddm
  • SHA256 9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a
  • MD5 SHA1 SHA512
Score
10/10
xloaderoecdloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • oecd

Decoy

  • mrcrickethighlights.com

  • milozzo.com

  • biggorillacreative.com

  • pecwi67.store

  • stoneeast.com

  • redicredi.com

  • warrentonvalodging.com

  • lexbbc.com

  • acmet-shirtco.com

  • grocits.com

  • vlconstruction.info

  • jxstore1.com

  • lifeenrollmarketplace.com

  • wgr5n.xyz

  • 710wgm.com

  • ccrdidkqpoxzrrpfpmcb.com

  • boswellbrothersofnc.net

  • girajewelry.com

  • primesukkah.com

  • daotengge.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.16119.3116
    • Size 449KB
    • SHA256 9384b3c5ba07e22c69a0a681cb14f98e2f8d0274858e2ad12371d000c844ab4a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderoecdloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks