Overview

overview

10

Static

static

3

089176f8b7...b3.exe

windows7-x64

089176f8b7...b3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    089176f8b75aeadbe1340475a97b64b3
  • Size 587KB
  • Sample231224-v21a1ahgem
  • SHA256 4adb1957fc3c427382fe6fa8daaa5af58bffd5aa251daaaa73604ec7355eadf5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderc3scloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • c3sc

Decoy

  • vnye2037.com

  • adopttongling.com

  • miss-bim.com

  • ylyqrbii.icu

  • iregentos.info

  • teseipropiedades.com

  • jsprimer.com

  • keepminkowicz.com

  • 7999399.com

  • bdgooddq.com

  • komovnrebi.com

  • politicalswim.com

  • justokaydrawings.com

  • eglidons.com

  • ici-voyant.com

  • thirstymarketing.com

  • viajesyturismo360.com

  • shadesofshadow.com

  • learnenglishinceret.com

  • notnotdown.club

Targets

    • Target
      089176f8b75aeadbe1340475a97b64b3
    • Size 587KB
    • SHA256 4adb1957fc3c427382fe6fa8daaa5af58bffd5aa251daaaa73604ec7355eadf5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderc3scloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks