Overview

overview

10

Static

static

1

cad43af39f...57.exe

windows7_x64

10

cad43af39f...57.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cad43af39f983c31ad5579ea34a31457
  • Size 475KB
  • Sample211116-r2e4aaecb2
  • SHA256 71d93edf8e5a5f7128dc660fa599a41c96059fee16983769adb91b3b8353294f
  • MD5 SHA1 SHA512
Score
10/10
xloaderp0seloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p0se

C2

  • http://www.graylinkelectric.com/p0se/

Decoy

  • gayko.info

  • mgav67.xyz

  • serestovfleacollar.com

  • thievingfo.rest

  • theleadersmanifesto.com

  • mrteez.club

  • veryimportantagent.club

  • equitymedia.biz

  • standoutbeseen.com

  • antelbd.com

  • bailios.com

  • ftmex.net

  • oprimanumerodos.com

  • cbtnightmares.com

  • y0heykod2.xyz

  • iscinet.com

  • nutri6si.com

  • heavensplacerc.net

  • trungtambtx.com

  • tkxjx.com

Targets

    • Target
      cad43af39f983c31ad5579ea34a31457
    • Size 475KB
    • SHA256 71d93edf8e5a5f7128dc660fa599a41c96059fee16983769adb91b3b8353294f
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp0seloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks