Overview

overview

10

Static

static

1

Originalgo...12.exe

windows7_x64

10

Originalgo...12.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Originalgoodsorder2022_196532012.exe
  • Size 310KB
  • Sample220122-h13zaaacbn
  • SHA256 57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369
  • MD5 SHA1 SHA512
Score
10/10
xloaderssacloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ssac

Decoy

  • beautybybrin.com

  • oregemo.com

  • prospectoriq.com

  • blazermid.com

  • cloudnineloans.com

  • myyntisofta.com

  • filoupoils.com

  • web-solutiontnpasumo3.xyz

  • becbares.com

  • lines-hikkoshi.com

  • ohayouwww.com

  • writingdadsobituarywithdad.com

  • bridalbaes.com

  • jamshir.com

  • rangertots.com

  • dankbrobeans.com

  • titan111.com

  • uplearns.info

  • maxicashprokil.xyz

  • evc24.com

Targets

    • Target
      Originalgoodsorder2022_196532012.exe
    • Size 310KB
    • SHA256 57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderssacloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks