Overview

overview

10

Static

static

1

4264cf96c4...73.exe

windows7_x64

10

4264cf96c4...73.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4264cf96c4354a225036078ac1b06473
  • Size 426KB
  • Sample211216-mbcs1sbgd3
  • SHA256 bc83ad76bf99cf257e381272a7db0e07e7faac33aad6de6f2d12460e9022ff4a
  • MD5 SHA1 SHA512
Score
10/10
xloaderh0idloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • h0id

Decoy

  • monteiromt.com

  • biyell.com

  • fofdirect.com

  • savethatpost.com

  • goccedaynight.com

  • cryptopsales.com

  • aw-mall.com

  • ffmagic.com

  • luiscarloslopes.website

  • infiniteinfinites.com

  • getercnow.com

  • oudet-mall.com

  • bright-tailor.com

  • 3-h0.online

  • outerverse.space

  • apexpowerwashingservices.com

  • kyrstensinema2024.com

  • equalblog.com

  • deadbeatingheart.com

  • soundtilt.com

Targets

    • Target
      4264cf96c4354a225036078ac1b06473
    • Size 426KB
    • SHA256 bc83ad76bf99cf257e381272a7db0e07e7faac33aad6de6f2d12460e9022ff4a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderh0idloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks