Overview

overview

10

Static

static

MATERIAL T...03.exe

windows7_x64

10

MATERIAL T...03.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    MATERIAL TAKE OFF - GASKETS AND BOLTS P 5721025 00 001 12036 L003.exe
  • Size 531KB
  • Sample220416-yn8l1aagg3
  • SHA256 2273d198e458cede0e587d1c4d253a1853dee5e267659691f1758d2a87e50d77
  • MD5 SHA1 SHA512
Score
10/10
xloaderm3ciloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m3ci

Decoy

  • 424964.com

  • ocean-breath-retreat.com

  • icidedansdehors.art

  • wrochtthurl.quest

  • 6455gfg.top

  • dgfipmailservice.online

  • banjofarmenica.com

  • dkcazin.com

  • jobs-fp.com

  • karens-kornerr.com

  • parmaesq.com

  • nuevochile.net

  • inputsquad.com

  • consultacedula-sep.digital

  • taogoubao.net

  • gimmesolar.com

  • bluelacedefense.com

  • grandagent.club

  • warqatalzawaj.com

  • getvirbelanow.com

Targets

    • Target
      MATERIAL TAKE OFF - GASKETS AND BOLTS P 5721025 00 001 12036 L003.exe
    • Size 531KB
    • SHA256 2273d198e458cede0e587d1c4d253a1853dee5e267659691f1758d2a87e50d77
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm3ciloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks