Overview

overview

10

Static

static

4c077d585b...63.exe

windows7_x64

10

4c077d585b...63.exe

windows10-2004_x64

10

Resubmissions

23/02/2022, 14:10

220223-rgr74sadb810

23/02/2022, 13:42

220223-qzpdhaace610

Sharing

Copy URL Twitter E-mail

General

  • Target
    4c077d585b030adc7bd7c38cfb5a5963
  • Size 770KB
  • Sample220223-qzpdhaace6
  • SHA256 d6b928a4292c14dee552691c4955bdff07d038470ec1419c88a4018fb06bd399
  • MD5 SHA1 SHA512
Score
10/10
xloaderioxfloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ioxf

Decoy

  • thesynergyfestival.com

  • breathemoveinspire.com

  • htceyleisureindia.biz

  • ds0003.xyz

  • peterjacobsentattoo.com

  • sulahouse.com

  • edyhart.com

  • goncamp.com

  • mysb.tools

  • alorasportswear.com

  • beinwatch.xyz

  • itadvisor.systems

  • ds0001.xyz

  • thevermontlogcabin.com

  • bburagotr.xyz

  • 234qpm.com

  • otterburnelanding.com

  • fetch-us-borrow-money.zone

  • ryegames.net

  • ptintelligence.com

Targets

    • Target
      4c077d585b030adc7bd7c38cfb5a5963
    • Size 770KB
    • SHA256 d6b928a4292c14dee552691c4955bdff07d038470ec1419c88a4018fb06bd399
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderioxfloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks