Overview

overview

10

Static

static

MX-M502N_201145.exe

windows7_x64

10

MX-M502N_201145.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    MX-M502N_201145.exe
  • Size 1.1MB
  • Sample210624-en9n3eflnj
  • SHA256 4847c8f558aa540f7f018eae22699e59af2dbfee608b7076283ed79de65d8fcc
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.bodymoisturizer.online/q4kr/

Decoy

  • realmodapk.com

  • hanoharuka.com

  • shivalikspiritualproducts.com

  • womenshealthclinincagra.com

  • racketpark.com

  • startuporig.com

  • azkachinas.com

  • klanblog.com

  • linuxradio.tools

  • siteoficial-liquida.com

  • glsbuyer.com

  • bestdeez.com

  • teens2cash.com

  • valleyviewconstruct.com

  • myfortniteskins.com

  • cambecare.com

  • csec2011.com

  • idookap.com

  • warmwallsrecords.com

  • smartmirror.one

Targets

    • Target
      MX-M502N_201145.exe
    • Size 1.1MB
    • SHA256 4847c8f558aa540f7f018eae22699e59af2dbfee608b7076283ed79de65d8fcc
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks