Overview

overview

10

Static

static

cd0b47e252...a7.exe

windows7_x64

1

cd0b47e252...a7.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cd0b47e25276e64367681a38d0cd30a7.exe
  • Size 801KB
  • Sample220217-wslxpaeabk
  • SHA256 fe1906c3cfde64c8db41fc90fc08148fa8b9ecb7473142034b755a7344be953a
  • MD5 SHA1 SHA512
Score
10/10
xloaderu6f8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • u6f8

Decoy

  • xheis.com

  • stopthosepests.com

  • hfmediadept.com

  • sturgisbrews.com

  • ddphysio.com

  • felixubek.quest

  • flakapk.com

  • camluxflims.com

  • decorsisters.com

  • golittlepet.com

  • goldenwhitear.com

  • hybridsea.com

  • results-football.pro

  • builduprofler.xyz

  • gangaharengineer.com

  • buresdx.com

  • emilybuysproperty.com

  • bestmuz.club

  • nftos.net

  • returndiscounts.com

Targets

    • Target
      cd0b47e25276e64367681a38d0cd30a7.exe
    • Size 801KB
    • SHA256 fe1906c3cfde64c8db41fc90fc08148fa8b9ecb7473142034b755a7344be953a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderu6f8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks