Overview

overview

10

Static

static

PALLET MOL...RY.exe

windows7_x64

10

PALLET MOL...RY.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PALLET MOLD OFFER ENQUIRY.exe
  • Size 878KB
  • Sample220311-pf2n2shdc2
  • SHA256 d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212
  • MD5 SHA1 SHA512
Score
10/10
xloadermqr7loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mqr7

Decoy

  • hoangmyphanthiet.com

  • coton-house.com

  • miyazawatekkin-recruit.com

  • testbrainn.store

  • compassionatecuddling.com

  • finestar-asia.com

  • susneh.com

  • bvduntral.xyz

  • makewell-ca.com

  • mpfeapmc.xyz

  • khmertimez.com

  • nusrattelbdoffical.xyz

  • alltherapists.net

  • newvisiting.com

  • qwasx.top

  • adhek-internacional.com

  • threwards.com

  • emeiwu.com

  • petervidmarinvite.com

  • highgradeporcelain.com

Targets

    • Target
      PALLET MOLD OFFER ENQUIRY.exe
    • Size 878KB
    • SHA256 d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermqr7loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks