Overview

overview

10

Static

static

BANK DETAI...UK.exe

windows7_x64

10

BANK DETAI...UK.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    BANK DETAILS IBAN GB63BUK.exe
  • Size 487KB
  • Sample220131-lg25eshee5
  • SHA256 5fa95a2623ad47a5b74d6fdc6f3f95b976af3e8a8a40838c5a5acfc9549e8add
  • MD5 SHA1 SHA512
Score
10/10
xloadern8bsloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • n8bs

Decoy

  • monese-bank.com

  • silkypumps.xyz

  • tashabouvier.com

  • eduardoleonsilva.com

  • pinnaclecorporaterentals.com

  • megafluids.com

  • worldwidecarfans.com

  • benjamlnesq.com

  • unitedraxiapp.com

  • thetanheroes.com

  • jypmore.quest

  • indianasheriffs.biz

  • saintinstead.com

  • alldansmx.com

  • trulyproofreading.com

  • indotogel369.com

  • mermadekusse.store

  • radosenterprisellc.com

  • gseequalservices.com

  • techride.xyz

Targets

    • Target
      BANK DETAILS IBAN GB63BUK.exe
    • Size 487KB
    • SHA256 5fa95a2623ad47a5b74d6fdc6f3f95b976af3e8a8a40838c5a5acfc9549e8add
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern8bsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks