Overview

overview

10

Static

static

PARKING LI...EX.exe

windows7_x64

10

PARKING LI...EX.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PARKING LIST, BL AND TELEX.exe
  • Size 1.2MB
  • Sample220323-g9ht2aggc5
  • SHA256 66ed20e609a1c10376f30415f4f2a03aa274fbdaaa12925dcc81ed74bfb7fdfa
  • MD5 SHA1 SHA512
Score
10/10
xloaderm80eloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m80e

Decoy

  • 6567114.win

  • brunchexplorer.com

  • crustenc.net

  • gaydatingtv.com

  • 62j0.com

  • xn--e1agodcihdab8a.com

  • spankingseeker.com

  • ggoundteam.com

  • goldenempirerealities.com

  • delenitishire.online

  • gsjbd33.club

  • utensilqlxvmp.online

  • shiawaseprj.net

  • v-digitalc.net

  • arivestore.com

  • agnzla.biz

  • starlamovement.com

  • tillthespire.com

  • mauttick.com

  • beautyeditors.info

Targets

    • Target
      PARKING LIST, BL AND TELEX.exe
    • Size 1.2MB
    • SHA256 66ed20e609a1c10376f30415f4f2a03aa274fbdaaa12925dcc81ed74bfb7fdfa
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm80eloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks