Overview

overview

10

Static

static

64b8ce7163...6d.exe

windows7_x64

10

64b8ce7163...6d.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    64b8ce71634358d220c7eb599a73556d.exe
  • Size 337KB
  • Sample210728-ebdbedaqvs
  • SHA256 ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.extinctionbrews.com/dy8g/

Decoy

  • mzyxi-rkah-y.net

  • okinawarongnho.com

  • qq66520.com

  • nimbus.watch

  • cwdelrio.com

  • regalshopper.com

  • avito-payment.life

  • jorgeporcayo.com

  • galvinsky.digital

  • guys-only.com

  • asmfruits-almacenes.com

  • boatrace-life04.net

  • cochez.club

  • thelastvictor.net

  • janieleconte.com

  • ivoirepneus.com

  • saludflv.info

  • mydreamtv.net

  • austinphy.com

  • cajunseafoodstcloud.com

Targets

    • Target
      64b8ce71634358d220c7eb599a73556d.exe
    • Size 337KB
    • SHA256 ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks