Overview

overview

10

Static

static

1

ad5f62c4fb...1d.exe

windows7_x64

10

ad5f62c4fb...1d.exe

windows10-2004_x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    ad5f62c4fbd80e1c75c0442faa2eda1d
  • Size 248KB
  • Sample220131-qlnj2shgf3
  • SHA256 bc94f855af63f2b711742d13249e36791c034b6369ecdc79878c04de8a4dbd6b
  • MD5 SHA1 SHA512
Score
10/10
xloader3a4hloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 3a4h

Decoy

  • mohamedmansour.net

  • asap.green

  • influxair.com

  • 45mpt.xyz

  • cablerailingdesign.com

  • salesdisrupter.com

  • cxfarms.com

  • enerconfederal.com

  • pl1x.top

  • nyoz.top

  • fitnesz.website

  • minimi36.com

  • borealiselectricalrepair.com

  • miskalqurashi.com

  • importacionesdelfuturo.com

  • cigfinanacial.com

  • luxamata.xyz

  • digicoin724.com

  • gozabank.com

  • tribal-treasures.com

Targets

    • Target
      ad5f62c4fbd80e1c75c0442faa2eda1d
    • Size 248KB
    • SHA256 bc94f855af63f2b711742d13249e36791c034b6369ecdc79878c04de8a4dbd6b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader3a4hloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks