Overview

overview

10

Static

static

Purchase O...df.exe

windows7-x64

10

Purchase O...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Purchase Order Frank Manufactures.Pdf.exe
  • Size 812KB
  • Sample220726-vt9vgafba7
  • SHA256 14017a5f9a46c97ba874b288cb1f56a9ce838a0f91c12d8fbfa4265cef0d312d
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Targets

    • Target
      Purchase Order Frank Manufactures.Pdf.exe
    • Size 812KB
    • SHA256 14017a5f9a46c97ba874b288cb1f56a9ce838a0f91c12d8fbfa4265cef0d312d
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks