Overview

overview

10

Static

static

d1f47fde47...fe.exe

windows7_x64

10

d1f47fde47...fe.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d1f47fde475a365160c90907b192f5fe.exe
  • Size 754KB
  • Sample220627-kta12aaaap
  • SHA256 659e83e55702067d1a62f082238c752daf8b35e7eb66454cafb47b6618610009
  • MD5 SHA1 SHA512
Score
10/10
xloaderip4tloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • ip4t

Decoy

  • 710wgm.com

  • ournewhorizon.com

  • hilfe-online.xyz

  • suryaciptanusantara.com

  • hfrdwy.com

  • solutionscollection.com

  • savor.menu

  • fxivcama.com

  • freedom-recruitment.com

  • owldit.com

  • fullbiz.online

  • ztgifts.com

  • zerlastreeservices.com

  • simpleenergyai.com

  • ostheide-immobilien.com

  • mike-piano.com

  • xiheps.com

  • usedcarindonesia-ace.com

  • yuncuiyunying.xyz

  • hopecrtprotour.com

Targets

    • Target
      d1f47fde475a365160c90907b192f5fe.exe
    • Size 754KB
    • SHA256 659e83e55702067d1a62f082238c752daf8b35e7eb66454cafb47b6618610009
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderip4tloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks