Overview

overview

10

Static

static

1

c6def7e067...2c.exe

windows7_x64

10

c6def7e067...2c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c6def7e067895d7c6f4b0f78270b9e2c.exe
  • Size 281KB
  • Sample211102-nevnnscde7
  • SHA256 d78094f3b6eac87e2d4249671bdc4e044afb31e2e78aac8f2db7186c6d5b6db1
  • MD5 SHA1 SHA512
Score
10/10
xloaderkqnaloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • kqna

C2

  • http://www.surfsolutions.info/kqna/

Decoy

  • achyutlifesciences.com

  • anthemmg.com

  • netkopat.com

  • generationgirlnaturals.com

  • novatel-network.com

  • craftstockco.com

  • thevishantiverse.art

  • elkerfly.com

  • haerotechs.com

  • candypalette.com

  • gregdokes.com

  • e-commerce.company

  • gratitudeland.com

  • companyintelcloud.com

  • publicyazilim.com

  • xc6811.com

  • aracsozluk.com

  • janesgalant.quest

  • fraserstephendop.com

  • ryan.rentals

Targets

    • Target
      c6def7e067895d7c6f4b0f78270b9e2c.exe
    • Size 281KB
    • SHA256 d78094f3b6eac87e2d4249671bdc4e044afb31e2e78aac8f2db7186c6d5b6db1
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderkqnaloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks