Overview

overview

10

Static

static

adb9919502...65.exe

windows7_x64

10

adb9919502...65.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    adb9919502b31d7428478c1fc0118565
  • Size 995KB
  • Sample220321-mg3xdsbcg6
  • SHA256 c68894e6a7551cdf34c082a0ba372f9544d07aee0f2d09dfb7fed3e664e91aaf
  • MD5 SHA1 SHA512
Score
10/10
xloaderbnq2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • bnq2

Decoy

  • 457894197.biz

  • alpeshpate.com

  • casadepuravida.services

  • domelite.design

  • auto-service.online

  • marketingfinanceiras.website

  • thecompanyturkey.com

  • virtualfirstmonday.com

  • idebebtb.xyz

  • keenbootaustralia.com

  • naiduteja049.xyz

  • sddn4.xyz

  • cedarsservicesgroup.com

  • shakingqlxbur.online

  • h9modgame.club

  • clutterfix.biz

  • provasroy.com

  • institutparsec.com

  • billstechadvice.com

  • didadadaijia.com

Targets

    • Target
      adb9919502b31d7428478c1fc0118565
    • Size 995KB
    • SHA256 c68894e6a7551cdf34c082a0ba372f9544d07aee0f2d09dfb7fed3e664e91aaf
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderbnq2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks