Overview

overview

10

Static

static

dec61c4066...70.exe

windows7_x64

10

dec61c4066...70.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dec61c40661c7a5b70eab12cfead3e70.exe
  • Size 15KB
  • Sample220224-kwlkjsced6
  • SHA256 eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
  • MD5 SHA1 SHA512
Score
10/10
xloaderb80iloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • b80i

Decoy

  • yixuan5.com

  • jiazheng369.com

  • danielleefelipe.net

  • micorgas.com

  • uvywah.com

  • nbjcgl.com

  • streets4suites.com

  • hempgotas.com

  • postmoon.xyz

  • gaboshoes.com

  • pastodwes.com

  • libes.asia

  • damusalama.com

  • youngliving1.com

  • mollyagee.com

  • branchwallet.com

  • seebuehnegoerlitz.com

  • inventors.community

  • teentykarm.quest

  • 927291.com

Targets

    • Target
      dec61c40661c7a5b70eab12cfead3e70.exe
    • Size 15KB
    • SHA256 eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderb80iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks