Overview

overview

10

Static

static

nAIj8iSBKtENT6y.exe

windows7_x64

10

nAIj8iSBKtENT6y.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    nAIj8iSBKtENT6y.exe
  • Size 411KB
  • Sample210916-fa43jscaa8
  • SHA256 39c5b29df15e13a18cbc4b77a44208aa927af8851555a4d220d8af0be7aeb235
  • MD5 SHA1 SHA512
Score
10/10
xloadert75floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.4

Campaign

  • t75f

C2

  • http://www.438451.com/t75f/

Decoy

  • ice-lemon.pro

  • ar3spro.cloud

  • 9055837.com

  • fucksociety.net

  • prettyofficialx.com

  • mfxw.xyz

  • relationshipquiz.info

  • customia.xyz

  • juanayjuan.com

  • zidiankj.com

  • facture-booking.com

  • secondmining.store

  • aboutyou.club

  • gongxichen.com

  • laurabraincreative.com

  • pierrot-bros.com

  • saintpaulaccountingservices.com

  • dom-maya.com

  • garderobamarzen.net

  • la-salamandre-assurances.com

Targets

    • Target
      nAIj8iSBKtENT6y.exe
    • Size 411KB
    • SHA256 39c5b29df15e13a18cbc4b77a44208aa927af8851555a4d220d8af0be7aeb235
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadert75floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks