Overview

overview

10

Static

static

1

5363664ee5...14.exe

windows7_x64

10

5363664ee5...14.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5363664ee50748fee1f7c5f19928cd14
  • Size 357KB
  • Sample220112-mbc4saccep
  • SHA256 75e51d5e7662ad2c7ee23822ebf5246ce2d3257734ef87883f57bbcffe13c5d2
  • MD5 SHA1 SHA512
Score
10/10
xloaderc8teloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • c8te

Decoy

  • solendshop.com

  • petanimals2021.com

  • infullylucky.com

  • advisormarketing.online

  • hgfdsx.com

  • bjshsq.com

  • 43454255.xyz

  • newsexpressed.com

  • tenacityshipping.com

  • y-promotion.com

  • saltypigeon.com

  • acemodule.com

  • satisfaction-spa.com

  • evertownnyc.com

  • orgoheart.com

  • bankerszonemock.com

  • conveniente-prestamo.com

  • suprememodelmanagement.com

  • ego-designteam.com

  • mecanicotijuana.com

Targets

    • Target
      5363664ee50748fee1f7c5f19928cd14
    • Size 357KB
    • SHA256 75e51d5e7662ad2c7ee23822ebf5246ce2d3257734ef87883f57bbcffe13c5d2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderc8teloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks