Overview

overview

10

Static

static

3

Purchase_O...21.exe

windows7-x64

10

Purchase_O...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Purchase_Order-SAFCO_110162021.exe
  • Size 680KB
  • Sample231027-sfljlsfc2v
  • SHA256 bf6ccdb40c75ee410046cf7c4590b73d9d9f6e0c16e7d9bf0659b2ae264893e2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderbus9loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • bus9

Decoy

  • outcheatv.xyz

  • ktnplain.xyz

  • solutionsideas.online

  • partibebas.com

  • blueeng.net

  • immunotecduplicacion.com

  • lovarebtoyof4.xyz

  • dubaibeachluxury.com

  • chernika.group

  • gorgeoussignals.com

  • dxalq.com

  • lj-safe-keepingtoyof6.xyz

  • fluidthinker.com

  • mediafx.store

  • nielsqanalytics.com

  • aabmarketing.com

  • nightpartner96.xyz

  • palisadestahoeresorts.com

  • kanenari0129.com

  • rosekarat.quest

Targets

    • Target
      Purchase_Order-SAFCO_110162021.exe
    • Size 680KB
    • SHA256 bf6ccdb40c75ee410046cf7c4590b73d9d9f6e0c16e7d9bf0659b2ae264893e2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderbus9loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks