Overview

overview

10

Static

static

Offer and ...GO.exe

windows7_x64

10

Offer and ...GO.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Offer and Company LOGO.exe
  • Size 768KB
  • Sample210705-9ec7eers8a
  • SHA256 c5c7fee8ebfd267a7f8a220eee22206d43dbc608bb6842a95938f44e48483fad
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.rep.place/pba2/

Decoy

  • marshabenjamin.com

  • ipx-tv.com

  • 1826bet.net

  • free-story-civilizatiom.com

  • projecteightstudio.com

  • blaxies3.com

  • knowyourpharmacy.com

  • daviddelavariservices.space

  • hawaiidreamevents.com

  • chickdeal.net

  • toko363.com

  • flextech.design

  • americanprimativeguitar.com

  • sourcesfloor.com

  • project6212.com

  • eggbeaterhub.xyz

  • homefittness.com

  • eigenguard.com

  • bridgessd.com

  • wordabbler.com

Targets

    • Target
      Offer and Company LOGO.exe
    • Size 768KB
    • SHA256 c5c7fee8ebfd267a7f8a220eee22206d43dbc608bb6842a95938f44e48483fad
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks