Overview

overview

10

Static

static

3

0afe819fb6...93.exe

windows7-x64

10

0afe819fb6...93.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0afe819fb6bd54d591e7b5b368920793
  • Size 1.2MB
  • Sample231230-cf6lsaafg2
  • SHA256 68a5258c5c468efc0102b57b21cf9b641032d37746f510b2876d93a3271b10f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderwufnloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • wufn

Decoy

  • rsautoluxe.com

  • theroseofsharonsalon.com

  • singnema.com

  • nathanielwhite108.com

  • theforumonline.com

  • iqpt.info

  • joneshondaservice.com

  • fafene.com

  • solanohomebuyerclass.com

  • zwq.xyz

  • searchlakeconroehomes.com

  • briative.com

  • frystmor.city

  • systemofyouth.com

  • sctsmney.com

  • tv-safetrading.com

  • thesweetboy.com

  • occulusblu.com

  • pawsthemomentpetphotography.com

  • travelstipsguide.com

Targets

    • Target
      0afe819fb6bd54d591e7b5b368920793
    • Size 1.2MB
    • SHA256 68a5258c5c468efc0102b57b21cf9b641032d37746f510b2876d93a3271b10f2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderwufnloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks