Overview

overview

10

Static

static

c4152100ec...c1.exe

windows7_x64

10

c4152100ec...c1.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c4152100ece7c574e1a8e3af63fb43c1
  • Size 624KB
  • Sample220615-yytwlabhgr
  • SHA256 5bc966e22893f103baa526fdd1392a0350890a4a151670fe608f55f32eaa9c1b
  • MD5 SHA1 SHA512
Score
10/10
xloaderip4tloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • ip4t

Decoy

  • 710wgm.com

  • ournewhorizon.com

  • hilfe-online.xyz

  • suryaciptanusantara.com

  • hfrdwy.com

  • solutionscollection.com

  • savor.menu

  • fxivcama.com

  • freedom-recruitment.com

  • owldit.com

  • fullbiz.online

  • ztgifts.com

  • zerlastreeservices.com

  • simpleenergyai.com

  • ostheide-immobilien.com

  • mike-piano.com

  • xiheps.com

  • usedcarindonesia-ace.com

  • yuncuiyunying.xyz

  • hopecrtprotour.com

Targets

    • Target
      c4152100ece7c574e1a8e3af63fb43c1
    • Size 624KB
    • SHA256 5bc966e22893f103baa526fdd1392a0350890a4a151670fe608f55f32eaa9c1b
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderip4tloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks