Overview

overview

10

Static

static

1

7822fb98e2...07.exe

windows7_x64

10

7822fb98e2...07.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7822fb98e269ac46bec826639a713c07
  • Size 473KB
  • Sample211216-mbcs1scedn
  • SHA256 7fe0a610fcbcddb5d954efaf23d8d6c9eccf24b841b35ffa2956f4370ec106a6
  • MD5 SHA1 SHA512
Score
10/10
xloadernv6iloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • nv6i

Decoy

  • letastephennumnum.com

  • drazkiewicz.net

  • 25565532.net

  • luxuryneverhurts.club

  • consultoriajuridica.digital

  • ecppro.net

  • 45oldpostroad.com

  • rosikomall.com

  • farmaciacarmentoledofmas.com

  • debbiesellssummerline.com

  • cglvyoxu.com

  • bravadoqlxltj.online

  • asylumpayments.com

  • dmc--llc.com

  • study18.com

  • pinkrosespadubai.com

  • lifestylebrightness.club

  • nokujs.com

  • 29store.xyz

  • mylife-guide.net

Targets

    • Target
      7822fb98e269ac46bec826639a713c07
    • Size 473KB
    • SHA256 7fe0a610fcbcddb5d954efaf23d8d6c9eccf24b841b35ffa2956f4370ec106a6
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadernv6iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks