Overview

overview

10

Static

static

0OJZOa56I5JC3wS.exe

windows7_x64

10

0OJZOa56I5JC3wS.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0OJZOa56I5JC3wS.exe
  • Size 981KB
  • Sample220322-mntmasehf2
  • SHA256 b7abbe227ce2d0bb2c611e6e5b67e220261a5f2218ef18b22e3a794789cb1bfc
  • MD5 SHA1 SHA512
Score
10/10
xloaderiqofloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • iqof

Decoy

  • downssandblasting.online

  • shopcongan.info

  • financeservicesolutions.com

  • ehiconao.com

  • 15beverlydrive.com

  • happynize.net

  • findzx.net

  • kelly-peterson.xyz

  • datalign-exchange.com

  • kinemasterpro.pro

  • amage.agency

  • roleplayhr.com

  • movingikea.com

  • steinerikegeberg.com

  • nikolashadow.com

  • baumbestattung.net

  • mms12.xyz

  • cryptocurrencymarket.space

  • colt.business

  • neutralblocker.com

Targets

    • Target
      0OJZOa56I5JC3wS.exe
    • Size 981KB
    • SHA256 b7abbe227ce2d0bb2c611e6e5b67e220261a5f2218ef18b22e3a794789cb1bfc
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderiqofloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks