Overview

overview

10

Static

static

1

c0b3e89e6a...ac.exe

windows7_x64

10

c0b3e89e6a...ac.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c0b3e89e6ae15becdebd353a165b61ac.exe
  • Size 279KB
  • Sample220121-ryk55aaban
  • SHA256 c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e
  • MD5 SHA1 SHA512
Score
10/10
xloaderjdo2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • jdo2

Decoy

  • adopte-un-per.com

  • lmandarin.com

  • shonemurawni.quest

  • bantasis.com

  • jsdigitalekuns.net

  • hiddenroom.net

  • arungjerampangalengan.com

  • yinghongxw.com

  • buzzcupid.com

  • lattent.digital

  • faxtoemailguide.com

  • romanticfriryrose.com

  • ruleaou.com

  • mochiko-blog.com

  • sekireixploit.com

  • bcx-wiremesh.com

  • jobportalsg.com

  • wysspirit.com

  • iflycny.com

  • sh-cy17.com

Targets

    • Target
      c0b3e89e6ae15becdebd353a165b61ac.exe
    • Size 279KB
    • SHA256 c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderjdo2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks