Overview

overview

10

Static

static

1

d3ce4433b5...51.exe

windows7_x64

10

d3ce4433b5...51.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d3ce4433b5757b12d2ca92e4eda5fe51.exe
  • Size 270KB
  • Sample220209-tsjffsbahp
  • SHA256 820b1216485962fa3501dc8bd02a76bdb821fd7b6ffab858c4ebe135c4246090
  • MD5 SHA1 SHA512
Score
10/10
xloaderndf8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ndf8

Decoy

  • cantobait.com

  • theangularteam.com

  • qq2222.xyz

  • floridasteamclean.com

  • daffodilhilldesigns.com

  • mindfulagilecoaching.com

  • xbyll.com

  • jessicaepedro2021.net

  • ccssv.top

  • zenginbilgiler.com

  • partumball.com

  • 1681890.com

  • schippermediaproductions.com

  • m2volleyballclub.com

  • ooiase.com

  • sharingtechnology.net

  • kiminplaka.com

  • usedgeartrader.com

  • cosyba.com

  • foodfriendshipandyou.com

Targets

    • Target
      d3ce4433b5757b12d2ca92e4eda5fe51.exe
    • Size 270KB
    • SHA256 820b1216485962fa3501dc8bd02a76bdb821fd7b6ffab858c4ebe135c4246090
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderndf8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks