Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f9eafc2e0d113c33ff2ef3c080001165cde3e53b379662b35643d4cfaab9e25c
  • Size 861KB
  • Sample220615-xpqbdaeag7
  • SHA256 f9eafc2e0d113c33ff2ef3c080001165cde3e53b379662b35643d4cfaab9e25c
  • MD5 SHA1 SHA512
Score
10/10
xloadern9e0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • n9e0

Decoy

  • sezevoa.xyz

  • fastfoodcolombia.com

  • sportsonemanagement.com

  • tuftdayz.com

  • vastrawomen.com

  • budgetmattresscenter.com

  • grocits.com

  • deadrussiankids.com

  • cvicleaners.com

  • snn262.xyz

  • it-karaduman.net

  • cnbbanbk.com

  • bbwylqrqdkpxxa.com

  • elegantaura.website

  • hundredplusapps.com

  • bonsaidou.net

  • rhodeislandcrush.com

  • oawys.com

  • playandswitch.com

  • namoshr.com

Targets

    • Target
      f9eafc2e0d113c33ff2ef3c080001165cde3e53b379662b35643d4cfaab9e25c
    • Size 861KB
    • SHA256 f9eafc2e0d113c33ff2ef3c080001165cde3e53b379662b35643d4cfaab9e25c
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadern9e0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks