Overview

overview

10

Static

static

3

0951e0d47e...77.exe

windows7-x64

10

0951e0d47e...77.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0951e0d47ebe1b1800d5328d31d27277
  • Size 1.0MB
  • Sample231230-bb2llagdc8
  • SHA256 a9281b082b6a93be2a647fe04c54af6d3cf3bab6673d19ad6354bb3b60404fea
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderajs8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ajs8

Decoy

  • lotfysupport.net

  • tradingsentral.com

  • mobiles240.com

  • redecompre.com

  • mulliganjames.com

  • excursionlanzarote.com

  • n1getaccess.com

  • wirelessconsole.com

  • thevez.net

  • joygshpng.com

  • arandawines.com

  • eliassantis.net

  • racevc.com

  • mybluemonitor.com

  • jual-penggugurkandungan.com

  • connectgf.com

  • nmpsolutions.com

  • anipawesome.com

  • vissito.com

  • terracottagkp.com

Targets

    • Target
      0951e0d47ebe1b1800d5328d31d27277
    • Size 1.0MB
    • SHA256 a9281b082b6a93be2a647fe04c54af6d3cf3bab6673d19ad6354bb3b60404fea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderajs8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks