Overview

overview

10

Static

static

3

3a0f86482d...9b.exe

windows7-x64

10

3a0f86482d...9b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3a0f86482d12e9d3a275763997708d9b
  • Size 1.2MB
  • Sample231231-rzn86saag3
  • SHA256 b5918ac7fd3c3323260a3158fe0230b58cdb7098bb659285374e5e2dc1c75f7d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderu3r5loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • u3r5

Decoy

  • alashan.ltd

  • demopagephequan.online

  • garxznql.icu

  • unetart.com

  • dajiangzhibo15.com

  • influencer.fund

  • beverlyhills.city

  • strefafryzur.net

  • giftboxhawaii.com

  • ecotiare.com

  • homeandgardenradioshow.com

  • sageandsandco.com

  • laflesoley.com

  • icipatanegra.online

  • autovistoriapredial.net

  • xn--polenezkypark-pmb.com

  • cbdamic.com

  • aaronandmarissa.com

  • datasoma.digital

  • theclosetology.com

Targets

    • Target
      3a0f86482d12e9d3a275763997708d9b
    • Size 1.2MB
    • SHA256 b5918ac7fd3c3323260a3158fe0230b58cdb7098bb659285374e5e2dc1c75f7d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderu3r5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks