Overview

overview

10

Static

static

3

4e05c01fc9...b4.exe

windows7-x64

10

4e05c01fc9...b4.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    4e05c01fc9dcf68548c55e81728501b4
  • Size 336KB
  • Sample231226-dc2dbsbdhr
  • SHA256 8d167481e6f45383f10a657039cfa2bfaa4a29ccf4be55615a1fc57241e26c2d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderftgqloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ftgq

Decoy

  • naturalbeautyapparel.com

  • abtotalsolution.com

  • periclescapitalmanagement.com

  • pleasejustdont.com

  • ryanscode.com

  • carsandscooters.com

  • best-polarized-sunglasses.com

  • hoodshawaii.com

  • titaefred.com

  • tomrings.com

  • swededenoting.host

  • birthdaytease.com

  • xaydzn.com

  • scutganxun.com

  • gdzhongle.com

  • alossol.com

  • shivamshield.com

  • fashionnailsjohnston.com

  • jobuelas.com

  • arvopaert.com

Targets

    • Target
      4e05c01fc9dcf68548c55e81728501b4
    • Size 336KB
    • SHA256 8d167481e6f45383f10a657039cfa2bfaa4a29ccf4be55615a1fc57241e26c2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderftgqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks