Overview

overview

10

Static

static

1

1e1d3ebcf7...f2.exe

windows7_x64

10

1e1d3ebcf7...f2.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1e1d3ebcf735559256fe106de64001f2.exe
  • Size 219KB
  • Sample210310-efalgvjgrs
  • SHA256 99a0c13cf8d2bc4b4eb7579c8bc68471c4738b95b27fb771cb4640c5c4698d94
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.856380692.xyz/nsag/

Decoy

  • usopencoverage.com

  • 5bo5j.com

  • deliveryourvote.com

  • bestbuycarpethd.com

  • worldsourcecloud.com

  • glowtheblog.com

  • translations.tools

  • ithacapella.com

  • machinerysubway.com

  • aashlokhospitals.com

  • athara-kiano.com

  • anabittencourt.com

  • hakimkhawatmi.com

  • fashionwatchesstore.com

  • krishnagiri.info

  • tencenttexts.com

  • kodairo.com

  • ouitum.club

  • robertbeauford.net

  • polling.asia

Targets

    • Target
      1e1d3ebcf735559256fe106de64001f2.exe
    • Size 219KB
    • SHA256 99a0c13cf8d2bc4b4eb7579c8bc68471c4738b95b27fb771cb4640c5c4698d94
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks