Overview

overview

10

Static

static

Product De...22.exe

windows7_x64

10

Product De...22.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Product Details of Mini IOT CASE 2022.exe
  • Size 542KB
  • Sample220126-ty8yasfga8
  • SHA256 dec8cfd95e7f3b0db46981117fe82eb59daab642c20c1e1ecaffe45df22af8c8
  • MD5 SHA1 SHA512
Score
10/10
xloaders9neloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • s9ne

Decoy

  • digital-performance-award.com

  • fioratti.xyz

  • designluxre.com

  • cngangdun.com

  • restaurantperladelmare.com

  • davinci65.info

  • glossmans.com

  • firstsmileimaging.com

  • indevmobility.biz

  • mvptcodesupport.com

  • crustenc.net

  • raleighsportsacademy.com

  • boytoyporn.com

  • rojaspass.com

  • acmepaysage.fr

  • shopatdean.xyz

  • leonergsteve18870.com

  • elnahuel.com

  • ils.network

  • canto-libero.com

Targets

    • Target
      Product Details of Mini IOT CASE 2022.exe
    • Size 542KB
    • SHA256 dec8cfd95e7f3b0db46981117fe82eb59daab642c20c1e1ecaffe45df22af8c8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaders9neloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks