Overview

overview

10

Static

static

b88775d34b...19.exe

windows7_x64

10

b88775d34b...19.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b88775d34b1365688b02de95b3f2ef19.exe
  • Size 784KB
  • Sample220209-tsjffsahd9
  • SHA256 5de06778dd414ee2cc418f089914bb7a656ccf854a30a004d286599cda4c4013
  • MD5 SHA1 SHA512
Score
10/10
xloaderu6f8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u6f8

Decoy

  • xheis.com

  • stopthosepests.com

  • hfmediadept.com

  • sturgisbrews.com

  • ddphysio.com

  • felixubek.quest

  • flakapk.com

  • camluxflims.com

  • decorsisters.com

  • golittlepet.com

  • goldenwhitear.com

  • hybridsea.com

  • results-football.pro

  • builduprofler.xyz

  • gangaharengineer.com

  • buresdx.com

  • emilybuysproperty.com

  • bestmuz.club

  • nftos.net

  • returndiscounts.com

Targets

    • Target
      b88775d34b1365688b02de95b3f2ef19.exe
    • Size 784KB
    • SHA256 5de06778dd414ee2cc418f089914bb7a656ccf854a30a004d286599cda4c4013
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu6f8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks