Overview

overview

10

Static

static

Payment advice.exe

windows7_x64

10

Payment advice.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Payment advice.exe
  • Size 818KB
  • Sample220315-rlqvvaaghj
  • SHA256 b5f68589e66a77f33e475e9af009e1bedd6c11fae42f65da1886100bd11bc3f6
  • MD5 SHA1 SHA512
Score
10/10
xloaderqdq1loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • qdq1

Decoy

  • advertising-machine.online

  • photo.fail

  • loyaltyfaq.com

  • 7lywzx3mh.com

  • liberate2024.com

  • xn--xhqp74a1vhb74b.group

  • konekt-top.space

  • portraitsbypaul.com

  • cattlecoinranch.com

  • 3963.space

  • egigpay.com

  • thesouthlandband.com

  • vickywestmore.com

  • rewindau.com

  • 21countryplace.com

  • cuffingseasonfilm.com

  • variableclement.com

  • ericksonwebmail.com

  • lmczedu.com

  • brw-solutlons.com

Targets

    • Target
      Payment advice.exe
    • Size 818KB
    • SHA256 b5f68589e66a77f33e475e9af009e1bedd6c11fae42f65da1886100bd11bc3f6
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderqdq1loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks