Overview

overview

10

Static

static

3

0f03eab550...f4.exe

windows7-x64

10

0f03eab550...f4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0f03eab5505bb4a4df99ccead0fc28f4
  • Size 1.0MB
  • Sample231230-ffhfqsafa9
  • SHA256 aaa40ee2b509dc2b3a2f12f62d70565c85eb9aa13a7efd43bb86cfba0a3e1a88
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderushbloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ushb

Decoy

  • shopcavo.com

  • spowerschool.com

  • freekylerittenhouse.info

  • wipe4all.com

  • wounded-deer.com

  • poetasamigosypensadores.com

  • qteap.com

  • car-bingo.com

  • selbaje.com

  • amigofincorp.com

  • dirty-underwear.com

  • theyongeseries.com

  • watertreeinc.com

  • gemmacarulla.com

  • lauramagni.com

  • darkfliks.com

  • jjayphoto.com

  • chinnanmotors.com

  • intentionaltalentsolutions.com

  • oxiaer.com

Targets

    • Target
      0f03eab5505bb4a4df99ccead0fc28f4
    • Size 1.0MB
    • SHA256 aaa40ee2b509dc2b3a2f12f62d70565c85eb9aa13a7efd43bb86cfba0a3e1a88
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderushbloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks