Overview

overview

10

Static

static

1

776aa08b37...3f.exe

windows7_x64

10

776aa08b37...3f.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    776aa08b3744122876d56eddc0ce613f
  • Size 271KB
  • Sample220208-ym5hyseae7
  • SHA256 ef15eca83cb6c33e63b81fc047ebf055ea8d6855118fc616ec051ec0222307ac
  • MD5 SHA1 SHA512
Score
10/10
xloaderp86floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p86f

Decoy

  • lawrencetodolist.com

  • ci-ohio.com

  • otpravka-pochti-23v.xyz

  • evolutiondesign.academy

  • anentdugloord.com

  • niftyresult.com

  • partner2form.com

  • hffznt.com

  • asukas.online

  • heidefine.xyz

  • secure-c5.com

  • greenlink-engineering.com

  • dextraseo.online

  • apricitee.com

  • kenyansinus.com

  • dailangxiaozhan.com

  • deuxfemmes.store

  • overway.store

  • herostea.com

  • shaneparrottllc.com

Targets

    • Target
      776aa08b3744122876d56eddc0ce613f
    • Size 271KB
    • SHA256 ef15eca83cb6c33e63b81fc047ebf055ea8d6855118fc616ec051ec0222307ac
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp86floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks