Overview

overview

10

Static

static

dhl details.pdf.exe

windows7_x64

3

dhl details.pdf.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dhl details.pdf.exe
  • Size 791KB
  • Sample220405-wtql9sbbe3
  • SHA256 2522eb074537e2ea01f643fb1d5d4b7f5ab8d3f7cb6524f230ff5521c362cc3f
  • MD5 SHA1 SHA512
Score
10/10
xloaderuevbloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • uevb

Decoy

  • red-tee.com

  • attention-arnaque.com

  • melissaposeyphotography.com

  • appgamblers.com

  • atlasarchitect.com

  • callbribe.com

  • expd8group.com

  • szlzhang.com

  • xuetian8899665.com

  • zonjebeir.com

  • chicoliftassit.com

  • santuariodelplomo.online

  • spearyard.com

  • deliciasnancy.com

  • immovda.net

  • vfuhgerguy.store

  • tb4.xyz

  • buystructured.com

  • celebrityinfoarena.com

  • viaronsport.com

Targets

    • Target
      dhl details.pdf.exe
    • Size 791KB
    • SHA256 2522eb074537e2ea01f643fb1d5d4b7f5ab8d3f7cb6524f230ff5521c362cc3f
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderuevbloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks