Overview

overview

10

Static

static

e4c892aef5...50.exe

windows7_x64

10

e4c892aef5...50.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e4c892aef5cc8a224af323c3ad222a50
  • Size 816KB
  • Sample220125-mjt29secc2
  • SHA256 6e728d7a2e88ba45765fb4bbb1de4ddda1b3a402d5f31c04eddafe1962ab993c
  • MD5 SHA1 SHA512
Score
10/10
xloaderdpzzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • dpzz

Decoy

  • roadstown.com

  • idfaltd.com

  • infotechsearchgroup.com

  • elcuentodelaprincesa.com

  • youkutiyu88.com

  • wildparkresort.com

  • iss-sa.com

  • jmglaser.com

  • criticalthinking.store

  • cabinetsossa.com

  • satseconomy.com

  • newendtech.com

  • gran-piel.com

  • accoya.net

  • timothyschmallrealt.com

  • valentikaeventos.com

  • majestineprojector.com

  • love-austria.com

  • hermetikyogusmalikombi.com

  • karasevda-jor.com

Targets

    • Target
      e4c892aef5cc8a224af323c3ad222a50
    • Size 816KB
    • SHA256 6e728d7a2e88ba45765fb4bbb1de4ddda1b3a402d5f31c04eddafe1962ab993c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdpzzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks