Overview

overview

10

Static

static

21fc8f1e8a...e9.exe

windows7_x64

10

21fc8f1e8a...e9.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    21fc8f1e8a50cfbc74f250310b3c71e9
  • Size 379KB
  • Sample220127-sa124seeck
  • SHA256 f5e1a753c6adb55fcc3eb64d7252f7c43ea1d4d5c33a63a5fa4373b3ca323f8c
  • MD5 SHA1 SHA512
Score
10/10
xloaderdpzzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • dpzz

Decoy

  • roadstown.com

  • idfaltd.com

  • infotechsearchgroup.com

  • elcuentodelaprincesa.com

  • youkutiyu88.com

  • wildparkresort.com

  • iss-sa.com

  • jmglaser.com

  • criticalthinking.store

  • cabinetsossa.com

  • satseconomy.com

  • newendtech.com

  • gran-piel.com

  • accoya.net

  • timothyschmallrealt.com

  • valentikaeventos.com

  • majestineprojector.com

  • love-austria.com

  • hermetikyogusmalikombi.com

  • karasevda-jor.com

Targets

    • Target
      21fc8f1e8a50cfbc74f250310b3c71e9
    • Size 379KB
    • SHA256 f5e1a753c6adb55fcc3eb64d7252f7c43ea1d4d5c33a63a5fa4373b3ca323f8c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdpzzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks