Overview

overview

10

Static

static

3

123657146d...a4.exe

windows7-x64

10

123657146d...a4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    123657146d91536f96286717786d45a4.exe
  • Size 942KB
  • Sample240101-ltv7msagh9
  • SHA256 4a82f9fe9128707c38e60ee4feea398d4edfcca38d066ed3670b5858d8685a05
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderearzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • earz

Decoy

  • halacoupon.com

  • anthos-labs.com

  • hagertylabs.net

  • l1992.com

  • 856379580.xyz

  • rcbb-technologies.com

  • realhoggapparel.com

  • sauceprince.com

  • tootingcab.com

  • 4chase5.com

  • ordergogibibimbap.com

  • nyj.xyz

  • dermixspa.com

  • premiergiftingco.com

  • razorcentric.com

  • mbrealtyadvisors.com

  • officialjazz.club

  • cctv006.com

  • hbcuatthepolls.info

  • prestamos-ya.com

Targets

    • Target
      123657146d91536f96286717786d45a4.exe
    • Size 942KB
    • SHA256 4a82f9fe9128707c38e60ee4feea398d4edfcca38d066ed3670b5858d8685a05
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderearzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks