Overview

overview

10

Static

static

3

IMG_38575943.exe

windows7-x64

10

IMG_38575943.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    IMG_38575943.exe
  • Size 341KB
  • Sample240415-1s3yeshd82
  • SHA256 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderc6siloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • c6si

Decoy

  • tristateinc.construction

  • americanscaregroundstexas.com

  • kanimisoshiru.com

  • wihling.com

  • fishcheekstosa.com

  • parentsfuid.com

  • greenstandmarket.com

  • fc8fla8kzq.com

  • gametwist-83.club

  • jobsncvs.com

  • directrealtysells.com

  • avida2015.com

  • conceptasite.net

  • arkaneattire.com

  • indev-mobility.info

  • 2160centurypark412.com

  • valefloor.com

  • septembership.com

  • stackflix.com

  • jimc0sales.net

Targets

    • Target
      IMG_38575943.exe
    • Size 341KB
    • SHA256 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderc6siloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks