Overview

overview

10

Static

static

AeYNBknvOvHA5AC.exe

windows7_x64

10

AeYNBknvOvHA5AC.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    AeYNBknvOvHA5AC.exe
  • Size 538KB
  • Sample220127-p2x8radce5
  • SHA256 b1fdff098dabc1d5beb91484f6f82637f359cb0f7fb4764b282c299c2d341ffa
  • MD5 SHA1 SHA512
Score
10/10
xloaderp89mloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p89m

Decoy

  • wrapapplausechutney.xyz

  • covidmobiletestingmd.com

  • convey.gifts

  • b148tlrfee9evtvorgm5947.com

  • zmlhtjfls.com

  • mctrumpthyism.com

  • lilaixi.store

  • interstatehardwarenj.com

  • horakokode.com

  • 42wilsonavenue.com

  • muskanphysio.com

  • absoluteuniquecrafts.store

  • donategame.online

  • greenlinkengineering.net

  • pinchanzosloyalty.com

  • companyintel.network

  • resumewriterguru.com

  • oakalleyatcimarron.com

  • sriyawealthplan.com

  • mpcollection.online

Targets

    • Target
      AeYNBknvOvHA5AC.exe
    • Size 538KB
    • SHA256 b1fdff098dabc1d5beb91484f6f82637f359cb0f7fb4764b282c299c2d341ffa
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp89mloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks