Overview

overview

10

Static

static

Payment Ad...df.exe

windows7_x64

10

Payment Ad...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Payment Advice_pdf.exe
  • Size 781KB
  • Sample210920-ltdmladeg6
  • SHA256 f8165688719f90b1ba956beb5f04d5aaa4afe8772fd38469f5a29efde6124546
  • MD5 SHA1 SHA512
Score
10/10
mimikatzxloaderu86gloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • u86g

C2

  • http://www.springgrowmeanairway.net/u86g/

Decoy

  • 4tnoxrox.com

  • ff130.com

  • grapevinecrisiscare.com

  • system91.com

  • blondedocfabprivacypolicy.com

  • amphorabeverageservices.com

  • cvacity.info

  • cbghemppills.com

  • iowaconcertofhope.com

  • theilerablog.com

  • bg1133.com

  • jenniferkristinphotography.com

  • wnj.xyz

  • khdoctor.com

  • mittelstandsgestaltung.com

  • mimikis.info

  • my-data.pro

  • nativesonlabs.com

  • thelincmagazine.com

  • dsfrederick.com

Targets

    • Target
      Payment Advice_pdf.exe
    • Size 781KB
    • SHA256 f8165688719f90b1ba956beb5f04d5aaa4afe8772fd38469f5a29efde6124546
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu86gloaderratmimikatz

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • mimikatz is an open source tool to dump credentials on Windows

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks