Overview

overview

10

Static

static

3

1dce0fc0bc...5f.exe

windows7-x64

10

1dce0fc0bc...5f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1dce0fc0bcc3ed4f7af74bdaeef37a5f
  • Size 1.2MB
  • Sample231230-1vnaragegp
  • SHA256 e8bb9e81ed75437b45f90b1c65e3100c618090d66d7fa37f5208fedc6972f142
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderwtenloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • wten

Decoy

  • largshomebuyers.com

  • hqs.xyz

  • stormvalleysoapco.com

  • coolsoftware.xyz

  • creditfitbootcamp.com

  • mdroc.com

  • cooperseyewear.com

  • mrleyos.com

  • apipacking.com

  • mtdivas.com

  • bim3dstudio.com

  • ngdnwgtsf.club

  • arknmhsc.com

  • expowe.icu

  • surfacesupplierscanada.com

  • thinbluelion.com

  • vbetmalaysia.com

  • christcarriers.com

  • easternshoreautobody.com

  • healthyvibrantandbeautiful.com

Targets

    • Target
      1dce0fc0bcc3ed4f7af74bdaeef37a5f
    • Size 1.2MB
    • SHA256 e8bb9e81ed75437b45f90b1c65e3100c618090d66d7fa37f5208fedc6972f142
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderwtenloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks