Overview

overview

10

Static

static

f8391a575f...39.exe

windows7_x64

10

f8391a575f...39.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f8391a575fe6ee058583475279454639
  • Size 1.0MB
  • Sample220223-rraqtabgdp
  • SHA256 25c2cea54ad6c1b93026807e6a34e7278f4dbdb85fdd635cbcc83e7f247e3f19
  • MD5 SHA1 SHA512
Score
10/10
xloadermc3wloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mc3w

Decoy

  • pegasusworlddigital.com

  • lumbungpanganreborn.com

  • familyresourcesystems.com

  • smallbusniessbenefits.com

  • strategia-firm.xyz

  • rokkos.club

  • geo1.tirol

  • dreamnft.xyz

  • yourprofits6.com

  • plshi.top

  • atmosferas.net

  • appcast-76.com

  • lilufigu.digital

  • jobby.guide

  • bregnic.art

  • stooshbotanicals.com

  • tiktok-lifts.com

  • dozercafe.com

  • parmarthmissionhospital.com

  • yufude.com

Targets

    • Target
      f8391a575fe6ee058583475279454639
    • Size 1.0MB
    • SHA256 25c2cea54ad6c1b93026807e6a34e7278f4dbdb85fdd635cbcc83e7f247e3f19
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermc3wloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks