Overview

overview

10

Static

static

FedEx Ship...oc.exe

windows7_x64

10

FedEx Ship...oc.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    FedEx Shipment doc.exe
  • Size 1.0MB
  • Sample220324-nclb8agcc7
  • SHA256 90d258580952ea2255d7c14ea3778600d262ffdb5a05519b8899c09035e22aac
  • MD5 SHA1 SHA512
Score
10/10
xloaderqdq1loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • qdq1

Decoy

  • advertising-machine.online

  • photo.fail

  • loyaltyfaq.com

  • 7lywzx3mh.com

  • liberate2024.com

  • xn--xhqp74a1vhb74b.group

  • konekt-top.space

  • portraitsbypaul.com

  • cattlecoinranch.com

  • 3963.space

  • egigpay.com

  • thesouthlandband.com

  • vickywestmore.com

  • rewindau.com

  • 21countryplace.com

  • cuffingseasonfilm.com

  • variableclement.com

  • ericksonwebmail.com

  • lmczedu.com

  • brw-solutlons.com

Targets

    • Target
      FedEx Shipment doc.exe
    • Size 1.0MB
    • SHA256 90d258580952ea2255d7c14ea3778600d262ffdb5a05519b8899c09035e22aac
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderqdq1loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks