Overview

overview

10

Static

static

DHL Shipme...83.exe

windows7_x64

10

DHL Shipme...83.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DHL Shipment Notification 74683783.exe
  • Size 590KB
  • Sample211011-hkshlsgec4
  • SHA256 e4f8b98f8e13c39a8a37fe7f2ac39f76790ae154a1a47941d889c663675e970e
  • MD5 SHA1 SHA512
Score
10/10
xloaderi6rdloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • i6rd

C2

  • http://www.csuiteweekly.com/i6rd/

Decoy

  • ritotvmount.xyz

  • szxhpfk.com

  • yatakturkiye.com

  • belugacdn.xyz

  • doralopen.com

  • gongzyrxzlhurhhhvdclmddi.store

  • lyvconsulting.com

  • it-pampering.com

  • weerwi.com

  • phdelivery1.store

  • neofluentsurf.com

  • lainsurance.xyz

  • ietaricardocastellarbarrios.com

  • despachantemedeiros.digital

  • madnext.online

  • serenity.holdings

  • rfvb.club

  • nickroche.online

  • hnjst.net

  • wolkeverts.quest

Targets

    • Target
      DHL Shipment Notification 74683783.exe
    • Size 590KB
    • SHA256 e4f8b98f8e13c39a8a37fe7f2ac39f76790ae154a1a47941d889c663675e970e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderi6rdloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks