Overview

overview

10

Static

static

1

05ff4e6e81...a5.exe

windows7_x64

10

05ff4e6e81...a5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    05ff4e6e816ac6dec4dab71a9d3b18a5.exe
  • Size 247KB
  • Sample220131-jnpfssggfk
  • SHA256 5ed4b0af136119c2bc78ca0cc3e0b58f77fbe72e9c7218d7c64f3caa2e5eda5e
  • MD5 SHA1 SHA512
Score
10/10
xloaderjdo2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • jdo2

Decoy

  • adopte-un-per.com

  • lmandarin.com

  • shonemurawni.quest

  • bantasis.com

  • jsdigitalekuns.net

  • hiddenroom.net

  • arungjerampangalengan.com

  • yinghongxw.com

  • buzzcupid.com

  • lattent.digital

  • faxtoemailguide.com

  • romanticfriryrose.com

  • ruleaou.com

  • mochiko-blog.com

  • sekireixploit.com

  • bcx-wiremesh.com

  • jobportalsg.com

  • wysspirit.com

  • iflycny.com

  • sh-cy17.com

Targets

    • Target
      05ff4e6e816ac6dec4dab71a9d3b18a5.exe
    • Size 247KB
    • SHA256 5ed4b0af136119c2bc78ca0cc3e0b58f77fbe72e9c7218d7c64f3caa2e5eda5e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderjdo2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks