Overview

overview

10

Static

static

1

bd9aec0a34...87.exe

windows7_x64

10

bd9aec0a34...87.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bd9aec0a34faff8128695a9779bad787.exe
  • Size 279KB
  • Sample220121-tagtxaacer
  • SHA256 cfd1a77378decd68cd7a59307b77b93247bdd91e00de5111ecae6b5658c8665f
  • MD5 SHA1 SHA512
Score
10/10
xloadero6tgloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • o6tg

Decoy

  • turkscaicosonline.com

  • novelfoodtech.com

  • zgrmfww.com

  • gestionalcliente24hrs.store

  • postrojka.com

  • tapissier-uzes.com

  • tobytram.one

  • preamblegames.com

  • clicklinkzs.com

  • franksenen.com

  • beautygateway.net

  • foils-online.com

  • aout.us

  • promarkoperations.com

  • alignatura.com

  • changemylifefast.info

  • minbex.icu

  • internethustlersociety.com

  • chinacqn.com

  • fibsh.com

Targets

    • Target
      bd9aec0a34faff8128695a9779bad787.exe
    • Size 279KB
    • SHA256 cfd1a77378decd68cd7a59307b77b93247bdd91e00de5111ecae6b5658c8665f
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadero6tgloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks