Overview

overview

10

Static

static

RFQ.exe

windows7_x64

10

RFQ.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RFQ.exe
  • Size 435KB
  • Sample211222-k4htmafbf4
  • SHA256 cc4478165b692f7109f252816f64a1fbb9cbf32c0ff623a255d2c9cd235a2da8
  • MD5 SHA1 SHA512
Score
10/10
xloadergnuiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • gnui

Decoy

  • himalayanwanderwoods.com

  • finvi.guru

  • iphone13promax.show

  • rpfcomunicacao.com

  • inemilia.com

  • blboutiqueexchange.com

  • sukiller.com

  • tzwa.net

  • noemiklein.com

  • upscalepklptp.xyz

  • unboxk.com

  • greatamericanlandworks.com

  • bataperu.com

  • estebanacostapeugeot.com

  • gombc-a02.com

  • 642541.com

  • 13f465.com

  • jskswj.com

  • hibar.xyz

  • eltool.net

Targets

    • Target
      RFQ.exe
    • Size 435KB
    • SHA256 cc4478165b692f7109f252816f64a1fbb9cbf32c0ff623a255d2c9cd235a2da8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadergnuiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks