Overview

overview

10

Static

static

banco_tran...22.exe

windows7_x64

1

banco_tran...22.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    banco_transferencia0280222.exe
  • Size 54KB
  • Sample220228-tcsdeseeh5
  • SHA256 6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267
  • MD5 SHA1 SHA512
Score
10/10
xloaderuar3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uar3

Decoy

  • jogoreviravolta.com

  • keysine.com

  • sami60.com

  • morganators.com

  • referral.directory

  • campdiscount.info

  • vanwah.com

  • jmtmjz.com

  • der-transformationscode.com

  • evangelvalormedia.com

  • bedsidehomecare.com

  • novaair.net

  • privilegetroissecurity.com

  • elsiepupz.com

  • yy77kk.com

  • nt-renewable.com

  • alyaqoutalabyadhautoparts.com

  • start-play-now.com

  • myskew.com

  • himalaya-finance.com

Targets

    • Target
      banco_transferencia0280222.exe
    • Size 54KB
    • SHA256 6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderuar3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks