Overview

overview

10

Static

static

3

0bb660af76...a7.exe

windows7-x64

1

0bb660af76...a7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0bb660af76cd316fd2dae5a66506a1a7
  • Size 506KB
  • Sample231230-vggcdsafbn
  • SHA256 d53bae4b5ce931f64224d180b42eda418516d524ae0623571069c6bc30845fa3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderhf9jloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • hf9j

Decoy

  • jambokid.com

  • https-sso-btcturk.com

  • shanghainternational.com

  • xn--ehq51k.com

  • articulosalgusto.com

  • zelayabrothers.com

  • bestessentialsforhome.com

  • pretaporterbijoux.com

  • razorpak.com

  • tiroljobs24.com

  • wwwfallguysmobile.com

  • milehighdoorways.com

  • ourinternationalstory.com

  • warriorsgames.com

  • georgeskieffer.com

  • wearegrowthhackerz.site

  • rabbikatz.com

  • skystonemed.com

  • salvage-it.com

  • kvnjob.com

Targets

    • Target
      0bb660af76cd316fd2dae5a66506a1a7
    • Size 506KB
    • SHA256 d53bae4b5ce931f64224d180b42eda418516d524ae0623571069c6bc30845fa3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderhf9jloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks