Overview

overview

10

Static

static

f74d638dbf...07.exe

windows7_x64

10

f74d638dbf...07.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f74d638dbfd6af55bd91dbea9144b207.exe
  • Size 682KB
  • Sample211124-x7vntaggd5
  • SHA256 2ee00fc9a73fae3aa751e75cada3a45e8691a61af4e1ded00c82aa36afb5c41b
  • MD5 SHA1 SHA512
Score
10/10
xloaderrf5oloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • rf5o

C2

  • http://www.smartag1.xyz/rf5o/

Decoy

  • monacheesa.com

  • lightetdesign.com

  • curtisdanielstattoostudio.com

  • mephisto-romania.com

  • mariareis.space

  • smartoo.info

  • ayudasdelgobierno.com

  • 4444wns.com

  • ctpxqgycm.com

  • tenloe089.xyz

  • moldluck.com

  • infinitecraftsanddesigns.com

  • openseasports.com

  • magurifootwear.com

  • bunikeeper.com

  • astodome.com

  • oshirohego.com

  • creativemanuals.com

  • nerosbin.info

  • proceam.com

Targets

    • Target
      f74d638dbfd6af55bd91dbea9144b207.exe
    • Size 682KB
    • SHA256 2ee00fc9a73fae3aa751e75cada3a45e8691a61af4e1ded00c82aa36afb5c41b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderrf5oloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks