Overview

overview

10

Static

static

1

SKM-0614483-pdf.exe

windows7_x64

10

SKM-0614483-pdf.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SKM-0614483-pdf.pif
  • Size 303KB
  • Sample220121-31qdeadhd2
  • SHA256 2838dffa365f3f4d1b7b4c766cea66dc2be629fe7991c112894a40acae72e601
  • MD5 SHA1 SHA512
Score
10/10
xloaderuar3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uar3

Decoy

  • sgadvocats.com

  • mjscannabus.com

  • hilldaley.com

  • ksdollhouse.com

  • hotgiftboutique.com

  • purebloodsmeet.com

  • relaunched.info

  • cap-glove.com

  • productcollection.store

  • fulikyy.xyz

  • remoteaviationjobs.com

  • bestcleancrystal.com

  • virtualorganizationpartner.com

  • bookgocar.com

  • hattuafhv.quest

  • makonigroup.com

  • officecom-myaccount.com

  • malgorzata-lac.com

  • e-learningeducators.com

  • hygilaur.com

Targets

    • Target
      SKM-0614483-pdf.pif
    • Size 303KB
    • SHA256 2838dffa365f3f4d1b7b4c766cea66dc2be629fe7991c112894a40acae72e601
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderuar3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks