Overview

overview

10

Static

static

3

0c38fc3c0a...bb.exe

windows7-x64

10

0c38fc3c0a...bb.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0c38fc3c0a2465e3a15e1bac02f6b4bb
  • Size 252KB
  • Sample231225-heslesfdaq
  • SHA256 b84be8911946bbe709de08dcaa4c04efc8640d92889dd5603c8afaad142a79af
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderpagiloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • pagi

Decoy

  • makehrworkable.com

  • sound-wisdom.com

  • blacts.com

  • caenantglamping.com

  • meridiancpas.com

  • draughtedinn.co.uk

  • windywoodshc.com

  • mintmovileplus.com

  • pubgeventdailylogin.com

  • thesocialdzr.com

  • holapv.com

  • racevc.com

  • openpula.pro

  • wepreventstroke.com

  • autoclosy.com

  • enginkarabacak.com

  • 15096eec1652.info

  • buildthefoundation.net

  • pwilliamberciklaw.com

  • paramountrevenueadvisors.com

Targets

    • Target
      0c38fc3c0a2465e3a15e1bac02f6b4bb
    • Size 252KB
    • SHA256 b84be8911946bbe709de08dcaa4c04efc8640d92889dd5603c8afaad142a79af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderpagiloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks