Overview

overview

10

Static

static

1

SKM-973116...if.exe

windows7_x64

10

SKM-973116...if.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SKM-973116391_PDF.pif
  • Size 297KB
  • Sample220120-m71jyshfg2
  • SHA256 ef986fa9ac50432d1fc1be8e0ace872cbf28cf51d967d6d35647aa3f77acf94e
  • MD5 SHA1 SHA512
Score
10/10
xloaderuar3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uar3

Decoy

  • sgadvocats.com

  • mjscannabus.com

  • hilldaley.com

  • ksdollhouse.com

  • hotgiftboutique.com

  • purebloodsmeet.com

  • relaunched.info

  • cap-glove.com

  • productcollection.store

  • fulikyy.xyz

  • remoteaviationjobs.com

  • bestcleancrystal.com

  • virtualorganizationpartner.com

  • bookgocar.com

  • hattuafhv.quest

  • makonigroup.com

  • officecom-myaccount.com

  • malgorzata-lac.com

  • e-learningeducators.com

  • hygilaur.com

Targets

    • Target
      SKM-973116391_PDF.pif
    • Size 297KB
    • SHA256 ef986fa9ac50432d1fc1be8e0ace872cbf28cf51d967d6d35647aa3f77acf94e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderuar3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks