Overview

overview

10

Static

static

2f7c9029b9...78.exe

windows7_x64

10

2f7c9029b9...78.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2f7c9029b930382a47dc1559e4127d78
  • Size 387KB
  • Sample220127-sagcpsfad6
  • SHA256 32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
  • MD5 SHA1 SHA512
Score
10/10
xloaderi5nbloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • i5nb

Decoy

  • monkenram.com

  • ryhairclinic.com

  • smtrbrndmethod.com

  • skvela-plet.com

  • 1sa.space

  • duplicatedaves.com

  • tudesafiofit.com

  • stolenartnfts.com

  • htmconfeccoes.com

  • popitparadise.com

  • brightlightservices.net

  • restaurangveckan.one

  • yourlittlehelp.store

  • vsley.com

  • xxxpornmodels.com

  • lei.ink

  • ouch247tap.com

  • paradgmpharma.com

  • airdrop-binance.com

  • hip-hopyhvqha.online

Targets

    • Target
      2f7c9029b930382a47dc1559e4127d78
    • Size 387KB
    • SHA256 32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderi5nbloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks