Overview

overview

10

Static

static

8d24c63404...eb.exe

windows7_x64

10

8d24c63404...eb.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8d24c63404ed4aa348979245979242eb.exe
  • Size 810KB
  • Sample220209-tsjffsahe2
  • SHA256 9774f8078d941b17f5018bf3759bca9e62cfe4714ed55d5bd33737fcbba25ce3
  • MD5 SHA1 SHA512
Score
10/10
xloaderyrcyloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • yrcy

Decoy

  • ordermws-brands.com

  • jkbswj.com

  • dairatwsl.com

  • lewismiddleton.com

  • hevenorfeed.com

  • kovogueshop.com

  • cyberitconsultingz.com

  • besrbee.com

  • workerscompfl1.com

  • wayfinderacu.com

  • smplkindness.com

  • servicesitcy.com

  • babyvv.com

  • fly-crypto.com

  • chahuima.com

  • trist-n.tech

  • minjia56.com

  • oded.top

  • mes-dents-blanches.com

  • nethunsleather.com

Targets

    • Target
      8d24c63404ed4aa348979245979242eb.exe
    • Size 810KB
    • SHA256 9774f8078d941b17f5018bf3759bca9e62cfe4714ed55d5bd33737fcbba25ce3
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderyrcyloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks