Overview

overview

10

Static

static

PAYMENT COPY.exe

windows7_x64

10

PAYMENT COPY.exe

windows10-2004_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    PAYMENT COPY.exe
  • Size 475KB
  • Sample220517-nbdwrabab3
  • SHA256 c6eb55e95d67cd97e33c9db999877616465567fbab73a4ab2face292bb6df2f0
  • MD5 SHA1 SHA512
Score
10/10
xloader64pfloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • 64pf

Decoy

  • ambr-creative.com

  • hermesearthing.com

  • tenloe068.xyz

  • visainnovationsummit.com

  • cnshealthcare.care

  • holyguacamoly-fashion.com

  • auxiliaradministrativo.club

  • bodaisabelyalberto.com

  • clearviewpaservices.com

  • health-pro.xyz

  • yzxinl.com

  • construccionesfabara.com

  • avisionstudio.com

  • cloudaccountingfirm.com

  • effronscrap.com

  • kryptopilots.com

  • secondave.online

  • aquashion.com

  • imperial-brands-digital.com

  • horas24chile.com

Targets

    • Target
      PAYMENT COPY.exe
    • Size 475KB
    • SHA256 c6eb55e95d67cd97e33c9db999877616465567fbab73a4ab2face292bb6df2f0
    • MD5 SHA1 SHA512
    Score
    10/10
    xloader64pfloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks