Overview

overview

10

Static

static

vZnbpHVO9Ay3PKW.exe

windows7_x64

10

vZnbpHVO9Ay3PKW.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    vZnbpHVO9Ay3PKW.exe
  • Size 681KB
  • Sample220304-t78nwsfdd2
  • SHA256 943206c8028ed79aa0aafefa101ffa5d3034cf92b82f705556f12cf0a7eb5a5c
  • MD5 SHA1 SHA512
Score
10/10
xloaderk8yhloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • k8yh

Decoy

  • lift2.cloud

  • tradeplay.net

  • familyattorneybg.com

  • accurbizlist.com

  • xrcasino.online

  • walletwriter.space

  • tiendasbioaseo.com

  • mrcandywholesale.com

  • multicoopltda.com

  • buylebsack.com

  • pilatesvilanova.com

  • fendoremi.com

  • vmfband.com

  • hrtaro.com

  • todosartenes.net

  • glusanka.info

  • dusa.codes

  • cfcfcs.xyz

  • ecostarsenergy.com

  • tokenbooze.com

Targets

    • Target
      vZnbpHVO9Ay3PKW.exe
    • Size 681KB
    • SHA256 943206c8028ed79aa0aafefa101ffa5d3034cf92b82f705556f12cf0a7eb5a5c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderk8yhloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks