Overview

overview

10

Static

static

284b2c8deb...08.exe

windows7_x64

10

284b2c8deb...08.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    284b2c8deb3c323ef533a1943380ec08
  • Size 756KB
  • Sample220301-ldmwbsheb4
  • SHA256 9655ee4ca1167f87d9245041ab59e861d6b3bdde7897a3b4cb2deee8550bdaaa
  • MD5 SHA1 SHA512
Score
10/10
xloadercxbzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • cxbz

Decoy

  • daligtemno.quest

  • 785686.com

  • jttengineering.com

  • papayaflorida.com

  • qinuxshop.net

  • mihaialexandruhash.com

  • ezzycoins.com

  • bseafacepharma.online

  • relaymondbe.com

  • straightuppokeronline.com

  • thebranddanymz.com

  • derrickgolden.net

  • missedyou.quest

  • palmstone-realestate.com

  • windoors.net

  • freakyhamster.com

  • boodtv.com

  • softsellingsystem.com

  • axiemng.com

  • officejava.store

Targets

    • Target
      284b2c8deb3c323ef533a1943380ec08
    • Size 756KB
    • SHA256 9655ee4ca1167f87d9245041ab59e861d6b3bdde7897a3b4cb2deee8550bdaaa
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadercxbzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks