Overview

overview

10

Static

static

PO.10032021.exe

windows7_x64

10

PO.10032021.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO.10032021.exe
  • Size 830KB
  • Sample211004-qykc6agde2
  • SHA256 fbaf103427e20432a3dcf19733b5f447bb6f0b2e5c700c76df55c2d977d080ae
  • MD5 SHA1 SHA512
Score
10/10
xloaderpvxzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • pvxz

C2

  • http://www.finetipster.com/pvxz/

Decoy

  • imt-token.club

  • abravewayocen.online

  • shcloudcar.com

  • mshoppingworld.online

  • ncgf08.xyz

  • stuinfo.xyz

  • wesavetheplanetofficial.com

  • tourbox.xyz

  • believeinyourselftraining.com

  • jsboyat.com

  • aaeconomy.info

  • 9etmorea.info

  • purosepeti7.com

  • goticketly.com

  • pinkmemorypt.com

  • mylifewellnesscentre.com

  • iridina.online

  • petrestore.online

  • neema.xyz

  • novelfooditalia.com

Targets

    • Target
      PO.10032021.exe
    • Size 830KB
    • SHA256 fbaf103427e20432a3dcf19733b5f447bb6f0b2e5c700c76df55c2d977d080ae
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderpvxzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks