Overview

overview

10

Static

static

Payment 9....SD.exe

windows7_x64

10

Payment 9....SD.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Payment 9.10000 USD.exe
  • Size 933KB
  • Sample210322-tf1ls4drda
  • SHA256 92e01cf56625e95b0d5c7f0706403ddcb068bdcd82e82a45ed9c296f0df394d4
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.nutrigabrielacarvalho.com/m8es/

Decoy

  • 668ruby.com

  • bundlecableinternet.com

  • principal.properties

  • autumnpmx.com

  • guiadeourobr.com

  • e6onlinetour.com

  • aireservcoastal.com

  • adzamstore.net

  • lights-touch.com

  • outsourcingjuridique.com

  • eicgmbh.com

  • hicapitolize.com

  • poikaewf.com

  • xn--hndmixer-9za.info

  • mondopeak.com

  • sczhuangzhou.com

  • treeworxpros.com

  • hurricanelauraroofing.com

  • dt-hnjx.com

  • letopicy.com

Targets

    • Target
      Payment 9.10000 USD.exe
    • Size 933KB
    • SHA256 92e01cf56625e95b0d5c7f0706403ddcb068bdcd82e82a45ed9c296f0df394d4
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks