Overview

overview

10

Static

static

531544a3ba...49.exe

windows7_x64

10

531544a3ba...49.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    531544a3ba94737e9aee2c6ada39a149
  • Size 384KB
  • Sample220301-ldmwbsbaan
  • SHA256 54d3a5ab9cf83b63a50a382b1f3fe4f2bdc03620744b9ecdee74723415fccd9d
  • MD5 SHA1 SHA512
Score
10/10
xloader8gceloaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 8gce

Decoy

  • ultimaslot.net

  • jacqueegui.com

  • aktsecurity.com

  • beattietnpasumo1.xyz

  • kellerwilliamrealestate.com

  • cryptodouble2x3x.online

  • wilsoncreekarts.com

  • portalphotography.art

  • bocafoods.net

  • gloriamcarter.com

  • goodfellascandoit.com

  • xhypxjkc.com

  • mimisminiatureboutique.store

  • plidoo.com

  • splendidbelle.com

  • grand-cas1no.com

  • xegizas.xyz

  • awadhhomes.com

  • piecebin.com

  • baridipay.com

Targets

    • Target
      531544a3ba94737e9aee2c6ada39a149
    • Size 384KB
    • SHA256 54d3a5ab9cf83b63a50a382b1f3fe4f2bdc03620744b9ecdee74723415fccd9d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader8gceloaderpersistencerat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks