Overview

overview

10

Static

static

PO-RFQ # 0...f .exe

windows7_x64

10

PO-RFQ # 0...f .exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO-RFQ # 097663899 pdf .exe
  • Size 869KB
  • Sample210408-e4z2dmnjtj
  • SHA256 69be518fd3748193be11e41acb1fb3e674b6c3f898193dec0c595bf450b19cf8
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.aquaroyaume.com/uabu/

Decoy

  • khedutbajar.com

  • vehicleporn.com

  • misanthropedia.com

  • partum.life

  • tenshinstore.com

  • 51tayi.com

  • rgr.one

  • lattakia-imbiss.com

  • escalerasdemetal.com

  • nationalurc.info

  • prettygalglam.com

  • globalperfumery.com

  • ivulam.xyz

  • qingniang.club

  • quick2ulube.com

  • curiget.xyz

  • ujeiakosdka.com

  • lacapitalcaferestaurant.com

  • agarkovsport.online

  • okashidonya.com

Targets

    • Target
      PO-RFQ # 097663899 pdf .exe
    • Size 869KB
    • SHA256 69be518fd3748193be11e41acb1fb3e674b6c3f898193dec0c595bf450b19cf8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks