Overview

overview

10

Static

static

1

3df60fa9cf...e5.exe

windows7_x64

10

3df60fa9cf...e5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3df60fa9cf10c41e9a56f004f3f13de5.exe
  • Size 423KB
  • Sample211216-kfcmpsccem
  • SHA256 bada1121774aa2f95cba11aee3fb48c38c1a30f6995e9540eacfdaf400dbbd07
  • MD5 SHA1 SHA512
Score
10/10
xloaderyrcyloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • yrcy

Decoy

  • ordermws-brands.com

  • jkbswj.com

  • dairatwsl.com

  • lewismiddleton.com

  • hevenorfeed.com

  • kovogueshop.com

  • cyberitconsultingz.com

  • besrbee.com

  • workerscompfl1.com

  • wayfinderacu.com

  • smplkindness.com

  • servicesitcy.com

  • babyvv.com

  • fly-crypto.com

  • chahuima.com

  • trist-n.tech

  • minjia56.com

  • oded.top

  • mes-dents-blanches.com

  • nethunsleather.com

Targets

    • Target
      3df60fa9cf10c41e9a56f004f3f13de5.exe
    • Size 423KB
    • SHA256 bada1121774aa2f95cba11aee3fb48c38c1a30f6995e9540eacfdaf400dbbd07
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderyrcyloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks