Overview

overview

10

Static

static

Halkbank,pdf.exe

windows7_x64

10

Halkbank,pdf.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Halkbank,pdf.exe
  • Size 836KB
  • Sample220125-yvzbxaecd8
  • SHA256 fb1d5c8b2bd6b47bfeea96c2d66155232e2b67a2e6382980af8ee36bdb31362a
  • MD5 SHA1 SHA512
Score
10/10
xloadern8bsloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • n8bs

Decoy

  • monese-bank.com

  • silkypumps.xyz

  • tashabouvier.com

  • eduardoleonsilva.com

  • pinnaclecorporaterentals.com

  • megafluids.com

  • worldwidecarfans.com

  • benjamlnesq.com

  • unitedraxiapp.com

  • thetanheroes.com

  • jypmore.quest

  • indianasheriffs.biz

  • saintinstead.com

  • alldansmx.com

  • trulyproofreading.com

  • indotogel369.com

  • mermadekusse.store

  • radosenterprisellc.com

  • gseequalservices.com

  • techride.xyz

Targets

    • Target
      Halkbank,pdf.exe
    • Size 836KB
    • SHA256 fb1d5c8b2bd6b47bfeea96c2d66155232e2b67a2e6382980af8ee36bdb31362a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern8bsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks