Overview

overview

10

Static

static

INQUIRY 30562-JO.exe

windows7_x64

10

INQUIRY 30562-JO.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    INQUIRY 30562-JO.exe
  • Size 763KB
  • Sample220218-n87kbscea8
  • SHA256 882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
  • MD5 SHA1 SHA512
Score
10/10
xloaderdnqiloaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • dnqi

Decoy

  • globexglobalstore.com

  • nanshalife.online

  • sferastp.com

  • coastalriskga.com

  • vintagealiso.com

  • bremosa.com

  • dirtymindtees.com

  • nonsensehenough.com

  • stakecompare.com

  • alphablackcars.com

  • vinawap.mobi

  • subito-credit.xyz

  • infowebp.com

  • boomboombusiness.com

  • pestancecontrol.xyz

  • amazingspanishlook.com

  • nb-xingya.com

  • bhawanitransports.com

  • contractor-mart.com

  • igingood.com

Targets

    • Target
      INQUIRY 30562-JO.exe
    • Size 763KB
    • SHA256 882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderdnqiloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks