Overview

overview

10

Static

static

1

d443c85e46...8a.exe

windows7_x64

10

d443c85e46...8a.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d443c85e4687dda1d266d7bd47d6268a
  • Size 272KB
  • Sample220208-v5e48scbcq
  • SHA256 e8720afe9895124761086a0f00aa515997015669cc5332aebe99d5ea02ca7377
  • MD5 SHA1 SHA512
Score
10/10
xloader3a4hloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 3a4h

Decoy

  • mohamedmansour.net

  • asap.green

  • influxair.com

  • 45mpt.xyz

  • cablerailingdesign.com

  • salesdisrupter.com

  • cxfarms.com

  • enerconfederal.com

  • pl1x.top

  • nyoz.top

  • fitnesz.website

  • minimi36.com

  • borealiselectricalrepair.com

  • miskalqurashi.com

  • importacionesdelfuturo.com

  • cigfinanacial.com

  • luxamata.xyz

  • digicoin724.com

  • gozabank.com

  • tribal-treasures.com

Targets

    • Target
      d443c85e4687dda1d266d7bd47d6268a
    • Size 272KB
    • SHA256 e8720afe9895124761086a0f00aa515997015669cc5332aebe99d5ea02ca7377
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader3a4hloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks