Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33804adf1254ef1376ce4a0416ff03db837b5bf23a752b8483ffdc1738a5cb59

  • Size

    510KB

  • Sample

    220620-rnf4esgae4

  • MD5

    ed110000e4a38ea4c524a777c0b28a38

  • SHA1

    a82ea598a09bf51269131363d2ca1120e45c92aa

  • SHA256

    33804adf1254ef1376ce4a0416ff03db837b5bf23a752b8483ffdc1738a5cb59

  • SHA512

    b771cae1b0e7a25d58dbbdb60a86d39bed08d6c0f97d18b928cb1179dba6911f494b4cec853d169d3113f2a7afa1c3ac45e6fb74f6c6a1fa73978b9209c0de4e

Score
10/10
xloaderloaderrat

Malware Config

Targets

    • Target

      33804adf1254ef1376ce4a0416ff03db837b5bf23a752b8483ffdc1738a5cb59

    • Size

      510KB

    • MD5

      ed110000e4a38ea4c524a777c0b28a38

    • SHA1

      a82ea598a09bf51269131363d2ca1120e45c92aa

    • SHA256

      33804adf1254ef1376ce4a0416ff03db837b5bf23a752b8483ffdc1738a5cb59

    • SHA512

      b771cae1b0e7a25d58dbbdb60a86d39bed08d6c0f97d18b928cb1179dba6911f494b4cec853d169d3113f2a7afa1c3ac45e6fb74f6c6a1fa73978b9209c0de4e

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks