Overview

overview

10

Static

static

Nuovo elen...ni.exe

windows7_x64

6

Nuovo elen...ni.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nuovo elenco ordini.exe
  • Size 1.1MB
  • Sample220314-sfm3faghb9
  • SHA256 031e877589f97a23fae025f6f7ff04b31f5a4341fed57933191e1645b43cab32
  • MD5 SHA1 SHA512
Score
10/10
xloaderuj3cloaderpersistencerat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uj3c

Decoy

  • media4play.store

  • detractsloznk.xyz

  • istansw.com

  • best-weight-loss.website

  • orchids22.com

  • cjbd68.com

  • fu5544.com

  • covidworld.info

  • nguyenthanhanh.com

  • aerodisinfectant.com

  • restaurantebrasasylea.com

  • woodencok.com

  • nxtzhhxt.com

  • tandemfinancialaz.com

  • newagespiritualitystore.com

  • thomasophie.online

  • ottnershop.com

  • sat-tabacologie.com

  • tj2988.com

  • colocauto.com

Targets

    • Target
      Nuovo elenco ordini.exe
    • Size 1.1MB
    • SHA256 031e877589f97a23fae025f6f7ff04b31f5a4341fed57933191e1645b43cab32
    • MD5 SHA1 SHA512
    Score
    10/10
    persistencexloaderuj3cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks