Overview

overview

10

Static

static

vbc.exe

windows7_x64

7

vbc.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    vbc.exe
  • Size 721KB
  • Sample220110-q2ebbaecf4
  • SHA256 2ff07642867f534743f26a3783850d83f59d74bf6860831577ccf26d52ae88ee
  • MD5 SHA1 SHA512
Score
10/10
xloadercxbzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • cxbz

Decoy

  • daligtemno.quest

  • 785686.com

  • jttengineering.com

  • papayaflorida.com

  • qinuxshop.net

  • mihaialexandruhash.com

  • ezzycoins.com

  • bseafacepharma.online

  • relaymondbe.com

  • straightuppokeronline.com

  • thebranddanymz.com

  • derrickgolden.net

  • missedyou.quest

  • palmstone-realestate.com

  • windoors.net

  • freakyhamster.com

  • boodtv.com

  • softsellingsystem.com

  • axiemng.com

  • officejava.store

Targets

    • Target
      vbc.exe
    • Size 721KB
    • SHA256 2ff07642867f534743f26a3783850d83f59d74bf6860831577ccf26d52ae88ee
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadercxbzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks