Overview

overview

10

Static

static

3

c4033910ea...a9.exe

windows7-x64

10

c4033910ea...a9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c4033910eaa4944d2c84b15fb964cda9
  • Size 474KB
  • Sample231222-rt8qmadce3
  • SHA256 d8bbf0c15a39bb1dd36c71177d2e8c5a05b0531bd91c03800b8503dc23f662c7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadercpa3loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • cpa3

Decoy

  • hkp.xyz

  • marcinkwiatkowski.com

  • celebrityobserver.com

  • thelotsgroup.com

  • actusforums.com

  • cityparcelservice.com

  • apprig.com

  • naughtianalove.com

  • lesitedelanimation.com

  • taxes1234.com

  • citieyuan.com

  • kokonarafile.com

  • morenatives.com

  • iredreview.com

  • oddlywelladjusted.com

  • wpj.xyz

  • gofairlane.com

  • galtoubul.com

  • custompickem.com

  • partsandersenstormdoor.com

Targets

    • Target
      c4033910eaa4944d2c84b15fb964cda9
    • Size 474KB
    • SHA256 d8bbf0c15a39bb1dd36c71177d2e8c5a05b0531bd91c03800b8503dc23f662c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadercpa3loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks