Overview

overview

10

Static

static

1

7d9f7b92a0...5b.exe

windows7_x64

10

7d9f7b92a0...5b.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7d9f7b92a0d9fc1f456d6fbe4dd7e45b
  • Size 296KB
  • Sample220118-we7x1accg2
  • SHA256 c40915d082a87e80528c90dabc2a8ed32a7f4f7b6eb271a0a48d6cfdbefcae5d
  • MD5 SHA1 SHA512
Score
10/10
xloaderyrcyloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • yrcy

Decoy

  • ordermws-brands.com

  • jkbswj.com

  • dairatwsl.com

  • lewismiddleton.com

  • hevenorfeed.com

  • kovogueshop.com

  • cyberitconsultingz.com

  • besrbee.com

  • workerscompfl1.com

  • wayfinderacu.com

  • smplkindness.com

  • servicesitcy.com

  • babyvv.com

  • fly-crypto.com

  • chahuima.com

  • trist-n.tech

  • minjia56.com

  • oded.top

  • mes-dents-blanches.com

  • nethunsleather.com

Targets

    • Target
      7d9f7b92a0d9fc1f456d6fbe4dd7e45b
    • Size 296KB
    • SHA256 c40915d082a87e80528c90dabc2a8ed32a7f4f7b6eb271a0a48d6cfdbefcae5d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderyrcyloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks