Overview

overview

10

Static

static

9dea40f95d...bf.exe

windows7_x64

10

9dea40f95d...bf.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    9dea40f95d7f9fc69ecc3f3d77f9a6bf
  • Size 479KB
  • Sample220131-qlnj2shbhl
  • SHA256 bfb63f78c88894c097832d1073716db0d322456da3a2bccc15e57eac15fa903d
  • MD5 SHA1 SHA512
Score
10/10
xloaderp86floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p86f

Decoy

  • lawrencetodolist.com

  • ci-ohio.com

  • otpravka-pochti-23v.xyz

  • evolutiondesign.academy

  • anentdugloord.com

  • niftyresult.com

  • partner2form.com

  • hffznt.com

  • asukas.online

  • heidefine.xyz

  • secure-c5.com

  • greenlink-engineering.com

  • dextraseo.online

  • apricitee.com

  • kenyansinus.com

  • dailangxiaozhan.com

  • deuxfemmes.store

  • overway.store

  • herostea.com

  • shaneparrottllc.com

Targets

    • Target
      9dea40f95d7f9fc69ecc3f3d77f9a6bf
    • Size 479KB
    • SHA256 bfb63f78c88894c097832d1073716db0d322456da3a2bccc15e57eac15fa903d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp86floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks