Overview

overview

10

Static

static

1

a4a01b44d9...e7.exe

windows7_x64

10

a4a01b44d9...e7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a4a01b44d94bbafb4be073bd285fafe7.exe
  • Size 216KB
  • Sample210331-bphkrawvvs
  • SHA256 5e7b6e81d3f73322d73bf013d67f76e211f0e539296e00a53d93585b0c167ba2
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

C2

  • http://www.856380692.xyz/nsag/

Decoy

  • usopencoverage.com

  • 5bo5j.com

  • deliveryourvote.com

  • bestbuycarpethd.com

  • worldsourcecloud.com

  • glowtheblog.com

  • translations.tools

  • ithacapella.com

  • machinerysubway.com

  • aashlokhospitals.com

  • athara-kiano.com

  • anabittencourt.com

  • hakimkhawatmi.com

  • fashionwatchesstore.com

  • krishnagiri.info

  • tencenttexts.com

  • kodairo.com

  • ouitum.club

  • robertbeauford.net

  • polling.asia

Targets

    • Target
      a4a01b44d94bbafb4be073bd285fafe7.exe
    • Size 216KB
    • SHA256 5e7b6e81d3f73322d73bf013d67f76e211f0e539296e00a53d93585b0c167ba2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks