Overview

overview

10

Static

static

26663089f8...30.exe

windows7_x64

3

26663089f8...30.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    26663089f8c68e799360aedc5b1a0b30
  • Size 480KB
  • Sample220131-kg9c3ahea7
  • SHA256 0377503f9ea4c7434be2f46af869900b9839be33121edcbdeeae9b8d8e0cdcce
  • MD5 SHA1 SHA512
Score
10/10
xloadernt3floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • nt3f

Decoy

  • tricyclee.com

  • kxsw999.com

  • wisteria-pavilion.com

  • bellaclancy.com

  • promissioskincare.com

  • hzy001.xyz

  • checkouthomehd.com

  • soladere.com

  • point4sales.com

  • socalmafia.com

  • libertadysarmiento.online

  • nftthirty.com

  • digitalgoldcryptostock.net

  • tulekiloscaird.com

  • austinfishandchicken.com

  • wlxxch.com

  • mgav51.xyz

  • landbanking.global

  • saprove.com

  • babyfaces.skin

Targets

    • Target
      26663089f8c68e799360aedc5b1a0b30
    • Size 480KB
    • SHA256 0377503f9ea4c7434be2f46af869900b9839be33121edcbdeeae9b8d8e0cdcce
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadernt3floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks