Overview

overview

10

Static

static

8893fe00e5...75.exe

windows7_x64

10

8893fe00e5...75.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8893fe00e5bfd3794018c17254c26375.exe
  • Size 820KB
  • Sample220209-tqthmsbagn
  • SHA256 cba2f725d2b6b4212d2e8ba58b7e26e59e3276065d1f58fd11eeeaf0dfb15aeb
  • MD5 SHA1 SHA512
Score
10/10
xloaderdpzzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • dpzz

Decoy

  • roadstown.com

  • idfaltd.com

  • infotechsearchgroup.com

  • elcuentodelaprincesa.com

  • youkutiyu88.com

  • wildparkresort.com

  • iss-sa.com

  • jmglaser.com

  • criticalthinking.store

  • cabinetsossa.com

  • satseconomy.com

  • newendtech.com

  • gran-piel.com

  • accoya.net

  • timothyschmallrealt.com

  • valentikaeventos.com

  • majestineprojector.com

  • love-austria.com

  • hermetikyogusmalikombi.com

  • karasevda-jor.com

Targets

    • Target
      8893fe00e5bfd3794018c17254c26375.exe
    • Size 820KB
    • SHA256 cba2f725d2b6b4212d2e8ba58b7e26e59e3276065d1f58fd11eeeaf0dfb15aeb
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdpzzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks