Overview

overview

10

Static

static

VC-Q-10564...R1.exe

windows7_x64

10

VC-Q-10564...R1.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    VC-Q-1056410-21GR1.exe
  • Size 714KB
  • Sample211006-l8g9bsbab4
  • SHA256 f76c77ec8ce93ed76e97e714bb04a010ec289f3a08c321e95ac09c4f4285b2c5
  • MD5 SHA1 SHA512
Score
10/10
xloaderepnsloaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • epns

C2

  • http://www.lnvietnam.online/epns/

Decoy

  • mmfaccao.com

  • blttsperma.quest

  • 946abe.net

  • indispensablehands.com

  • jkformationfrance.com

  • phonerepaire.com

  • lienquan-trian.com

  • youkuti.com

  • empowermindbodystudios.com

  • seunicapf.com

  • fk-link.xyz

  • kunai.tech

  • difficultbutdoablebrand.com

  • ejworkspace.com

  • teracorp.biz

  • thekids.today

  • quintaalentejana.com

  • annaviruksham.com

  • jshengrong.com

  • nsmetalmakina.xyz

Targets

    • Target
      VC-Q-1056410-21GR1.exe
    • Size 714KB
    • SHA256 f76c77ec8ce93ed76e97e714bb04a010ec289f3a08c321e95ac09c4f4285b2c5
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderepnsloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks