Overview

overview

10

Static

static

1

PO6766.exe

windows7_x64

10

PO6766.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO6766.exe
  • Size 530KB
  • Sample220119-rnfgwsaeh7
  • SHA256 194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
  • MD5 SHA1 SHA512
Score
10/10
xloadergab7loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • gab7

Decoy

  • mbb11.xyz

  • taishancable.com

  • karaoke-sega.com

  • mana-space.com

  • danielandkaela.com

  • ancorasports.com

  • magentaclass.com

  • tenloe045.xyz

  • colorbold.com

  • 5starrentertainment.com

  • candgconstructiontx.com

  • 664cqi.com

  • alexeykazakov.com

  • umrashed.space

  • thepowerof10.club

  • scotchwoodofficeworks.com

  • anelis.digital

  • label34.group

  • karimico.com

  • dogsforsaleinkenya.com

Targets

    • Target
      PO6766.exe
    • Size 530KB
    • SHA256 194eecb866b404241cc14abfccf3ece512927dafff1e64248e1b1fb4e4acbd26
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadergab7loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks