Overview

overview

10

Static

static

5Zz9KAHYHkXiaY8.exe

windows7_x64

1

5Zz9KAHYHkXiaY8.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5Zz9KAHYHkXiaY8.exe
  • Size 791KB
  • Sample220307-rt5nzafdb9
  • SHA256 39586764971f496d274f3d453029954720962ed36672050b742aef8b4e68a78e
  • MD5 SHA1 SHA512
Score
10/10
xloadericunloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • icun

Decoy

  • cushionfuid.com

  • nault.biz

  • blackeyesystem.com

  • cloudbreak.info

  • fengxueshe.xyz

  • raxzrecords.com

  • shjedu.com

  • ai-vacancy.online

  • bittigibi.com

  • trabajaencasa.xyz

  • afjdisposal.com

  • aboutrealestatenewyork.com

  • vinomartin.com

  • u0biitep9.xyz

  • mayoreomaskking.com

  • ammastone.com

  • windrowpklnmf.xyz

  • baznasdumai.com

  • campusodontologia.online

  • viciouspor.xyz

Targets

    • Target
      5Zz9KAHYHkXiaY8.exe
    • Size 791KB
    • SHA256 39586764971f496d274f3d453029954720962ed36672050b742aef8b4e68a78e
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadericunloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks