Overview

overview

10

Static

static

be22dfbbdb...3f.exe

windows7_x64

10

be22dfbbdb...3f.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    be22dfbbdb5d473c79c71de4270ad63f
  • Size 733KB
  • Sample220308-ww16saacc2
  • SHA256 d8aa0a0e024a8dbabf0ff61cb75a879e2dac0c2ca537049cb86a64071ecf6a33
  • MD5 SHA1 SHA512
Score
10/10
xloadery329loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • y329

Decoy

  • chatbotcop.com

  • 869771.com

  • gnafleet.com

  • ktnanswer.xyz

  • shawtopia.com

  • henrycomms.com

  • galwayaccounting.com

  • shootingstarspix.com

  • stronghal.com

  • xammtdn.com

  • enfermerabilingue.biz

  • szbnp.com

  • toyota-fr.online

  • gorgeoussignals.com

  • anytimemoney.online

  • oneupcap.net

  • shieldhomeservice.com

  • thefss.online

  • vinnyvee.com

  • dailyblackcoffee.club

Targets

    • Target
      be22dfbbdb5d473c79c71de4270ad63f
    • Size 733KB
    • SHA256 d8aa0a0e024a8dbabf0ff61cb75a879e2dac0c2ca537049cb86a64071ecf6a33
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadery329loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks