Overview

overview

10

Static

static

SecuriteIn...41.exe

windows7_x64

10

SecuriteIn...41.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Scr.Malcodegdn30.7041.30764
  • Size 519KB
  • Sample220413-eagrkseaa2
  • SHA256 574fa65d6f75e60274434f27f9f28f439c093ba8ba7eb8303a441a5e851d70c8
  • MD5 SHA1 SHA512
Score
10/10
xloaderge43loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ge43

Decoy

  • ksyfgw9.com

  • boudermadroo.quest

  • giftedelephant.store

  • beputis4.com

  • wearartthouapparel.com

  • pro-fit.info

  • thinkliquid.net

  • hakone-inariya.com

  • freedomlandacedemy.com

  • xkdbag.com

  • target-checkbalances.com

  • doublearoofs.com

  • findiesoft.com

  • abt-ramonaoptics.com

  • lesenegalais.info

  • nielsqanalytics.com

  • theseattlenotary.com

  • sinbec.com

  • bambam-crypto.com

  • tfcvintage.com

Targets

    • Target
      SecuriteInfo.com.Scr.Malcodegdn30.7041.30764
    • Size 519KB
    • SHA256 574fa65d6f75e60274434f27f9f28f439c093ba8ba7eb8303a441a5e851d70c8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderge43loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks