Overview

overview

10

Static

static

1c0d7999bc...f8.exe

windows7_x64

10

1c0d7999bc...f8.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1c0d7999bc0920ede300d9ba3964e4f8
  • Size 370KB
  • Sample211121-27d4aaeefp
  • SHA256 9bcafd023ee8060e5e47faa42a7868c53dc048ba94ffae683ed39cddfd9da853
  • MD5 SHA1 SHA512
Score
10/10
xloaderc28nloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • c28n

C2

  • http://www.alou-mall.com/c28n/

Decoy

  • stelltd.com

  • gerez.cloud

  • exnclub.xyz

  • irstaxboard.com

  • colombiahouseware.com

  • bullaestetica.com

  • idfcfirstbankannualreports.com

  • estedia.net

  • britrex.com

  • obt-shop.net

  • mobilehomeimpact.com

  • the-ali.com

  • tpassessoriaquitacao.com

  • telavangcafe.com

  • vvskrylix.com

  • abros88.com

  • solarladders.com

  • discount-tiles.com

  • etihadalfursan.com

  • maxflowo2.net

Targets

    • Target
      1c0d7999bc0920ede300d9ba3964e4f8
    • Size 370KB
    • SHA256 9bcafd023ee8060e5e47faa42a7868c53dc048ba94ffae683ed39cddfd9da853
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderc28nloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks