Overview

overview

10

Static

static

1

8009b800a4...de.exe

windows7_x64

10

8009b800a4...de.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8009b800a48a95126a61e337e9bdc8de
  • Size 420KB
  • Sample220105-kz15eaabb6
  • SHA256 deac58296321ec67026dc3de7275137fbdf1775e28fbd9e4d3bf528be7bc95ff
  • MD5 SHA1 SHA512
Score
10/10
xloadernv6iloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • nv6i

Decoy

  • letastephennumnum.com

  • drazkiewicz.net

  • 25565532.net

  • luxuryneverhurts.club

  • consultoriajuridica.digital

  • ecppro.net

  • 45oldpostroad.com

  • rosikomall.com

  • farmaciacarmentoledofmas.com

  • debbiesellssummerline.com

  • cglvyoxu.com

  • bravadoqlxltj.online

  • asylumpayments.com

  • dmc--llc.com

  • study18.com

  • pinkrosespadubai.com

  • lifestylebrightness.club

  • nokujs.com

  • 29store.xyz

  • mylife-guide.net

Targets

    • Target
      8009b800a48a95126a61e337e9bdc8de
    • Size 420KB
    • SHA256 deac58296321ec67026dc3de7275137fbdf1775e28fbd9e4d3bf528be7bc95ff
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadernv6iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks