Overview

overview

10

Static

static

106a2fed46...6a.exe

windows7_x64

10

106a2fed46...6a.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    106a2fed467108c871ec9945b5bf196a.exe
  • Size 757KB
  • Sample220211-mqldpscee8
  • SHA256 201616caaad839735dc703230c000ebb254e0435a77253e160622c8cfbe10cc6
  • MD5 SHA1 SHA512
Score
10/10
xloaderu6f8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u6f8

Decoy

  • xheis.com

  • stopthosepests.com

  • hfmediadept.com

  • sturgisbrews.com

  • ddphysio.com

  • felixubek.quest

  • flakapk.com

  • camluxflims.com

  • decorsisters.com

  • golittlepet.com

  • goldenwhitear.com

  • hybridsea.com

  • results-football.pro

  • builduprofler.xyz

  • gangaharengineer.com

  • buresdx.com

  • emilybuysproperty.com

  • bestmuz.club

  • nftos.net

  • returndiscounts.com

Targets

    • Target
      106a2fed467108c871ec9945b5bf196a.exe
    • Size 757KB
    • SHA256 201616caaad839735dc703230c000ebb254e0435a77253e160622c8cfbe10cc6
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu6f8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks