Overview

overview

10

Static

static

3

bd4acec724...27.exe

windows7-x64

10

bd4acec724...27.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bd4acec724764aff79889c171a7fa327
  • Size 1.2MB
  • Sample231228-bb4e7afgbq
  • SHA256 f922e5ed74050041bbdad3ab177c8c14d18c9147827b58e4bce90631c513cb6e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderh388loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • h388

Decoy

  • americangrindstone.com

  • qdy6.club

  • bestsecretrecipes.info

  • 11restoran.com

  • mrhashtags.com

  • theexecutivestudio.com

  • levilatte.com

  • indiantrio.com

  • msdhigh.com

  • spartandiesel.com

  • soccersundays.com

  • eliteworldcars.com

  • superlemon001.com

  • greenlight.school

  • kuryeforum.xyz

  • abc-322.com

  • campbellretreat.com

  • argonmode.net

  • movievilla.info

  • brateix.info

Targets

    • Target
      bd4acec724764aff79889c171a7fa327
    • Size 1.2MB
    • SHA256 f922e5ed74050041bbdad3ab177c8c14d18c9147827b58e4bce90631c513cb6e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderh388loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks