Overview

overview

10

Static

static

1935f5a6fc...1e.exe

windows7_x64

10

1935f5a6fc...1e.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1935f5a6fcc5915d4b46c6d0abbdf71e
  • Size 747KB
  • Sample220208-cykr2acbgj
  • SHA256 acb28239c256d400e79f51a7f83036d19daa0d814d32dcf765d8ec9aa0293cea
  • MD5 SHA1 SHA512
Score
10/10
xloaderu6f8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u6f8

Decoy

  • xheis.com

  • stopthosepests.com

  • hfmediadept.com

  • sturgisbrews.com

  • ddphysio.com

  • felixubek.quest

  • flakapk.com

  • camluxflims.com

  • decorsisters.com

  • golittlepet.com

  • goldenwhitear.com

  • hybridsea.com

  • results-football.pro

  • builduprofler.xyz

  • gangaharengineer.com

  • buresdx.com

  • emilybuysproperty.com

  • bestmuz.club

  • nftos.net

  • returndiscounts.com

Targets

    • Target
      1935f5a6fcc5915d4b46c6d0abbdf71e
    • Size 747KB
    • SHA256 acb28239c256d400e79f51a7f83036d19daa0d814d32dcf765d8ec9aa0293cea
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu6f8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks