Overview

overview

10

Static

static

1

39c29125a8...28.exe

windows7_x64

10

39c29125a8...28.exe

windows10-2004_x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    5614fc852594749ecfbc1f741c9a2ad20edce64652a5c422ed4ca7c5943184a7_1643743532785.zip
  • Size 239KB
  • Sample220201-x56nasbbf3
  • SHA256 660d63fb00fa5f47737a5b22014f8bdf22080722ac16da61216caa5e99210b65
  • MD5 SHA1 SHA512
Score
10/10
xloaderuar3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uar3

Decoy

  • sgadvocats.com

  • mjscannabus.com

  • hilldaley.com

  • ksdollhouse.com

  • hotgiftboutique.com

  • purebloodsmeet.com

  • relaunched.info

  • cap-glove.com

  • productcollection.store

  • fulikyy.xyz

  • remoteaviationjobs.com

  • bestcleancrystal.com

  • virtualorganizationpartner.com

  • bookgocar.com

  • hattuafhv.quest

  • makonigroup.com

  • officecom-myaccount.com

  • malgorzata-lac.com

  • e-learningeducators.com

  • hygilaur.com

Targets

    • Target
      39c29125a8c776bd6eed886f346804a23d518b77_1643743531128.bin
    • Size 251KB
    • SHA256 5614fc852594749ecfbc1f741c9a2ad20edce64652a5c422ed4ca7c5943184a7
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderuar3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks