Overview

overview

10

Static

static

Proforma I...16.exe

windows7_x64

10

Proforma I...16.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Proforma Invoice Documents for USD.78,116.exe
  • Size 637KB
  • Sample220228-he8mmsddh5
  • SHA256 48b9bb721ab60fa9fc9feecef6c4e513b4bfc2049c72f187bdea927b20aa3898
  • MD5 SHA1 SHA512
Score
10/10
xloaderok4eloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • ok4e

Decoy

  • drtuba.one

  • mosescorrea.com

  • xn--sxqt5eu0oo9u9la.xn--czru2d

  • hellounio.com

  • teamtigers.club

  • oceansaquariumnyc.com

  • pordges.com

  • pinewoodfairwayshoa.com

  • 961115694.xyz

  • adeelrazza.com

  • baymillsstudios.com

  • kobaygym.com

  • highwaymenstickers.com

  • ulysse-cazarbonne.com

  • mintnft.fund

  • enjoycarousel.com

  • odemix.com

  • craftncloud.com

  • linuxsauce.net

  • sirtechie.xyz

Targets

    • Target
      Proforma Invoice Documents for USD.78,116.exe
    • Size 637KB
    • SHA256 48b9bb721ab60fa9fc9feecef6c4e513b4bfc2049c72f187bdea927b20aa3898
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderok4eloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks