Overview

overview

10

Static

static

3

52787dbd8e...33.exe

windows7-x64

10

52787dbd8e...33.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    52787dbd8e044adbcb1a4510fb3cc733
  • Size 1.5MB
  • Sample240111-ejh11aebcr
  • SHA256 3f3c2d584a904ed976a130b022c037cbc477f620149436971ffe78c1e42e706d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderev6cloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ev6c

Decoy

  • sdomenechf.com

  • wealthyvend.com

  • nolimitscollective.com

  • producees.com

  • cleanequipsb.com

  • term-preview.us

  • openspacetechnicalsolutions.com

  • nubankbrasil.com

  • bluedaascorp.com

  • eco-friendly-goods.com

  • adione.club

  • magetu.info

  • daroudi.com

  • zgsmledlights.com

  • 1alnafrica.com

  • rescuingyourspace.com

  • venipe.com

  • kimrucker.com

  • for96phone.com

  • motomaxxmn.com

Targets

    • Target
      52787dbd8e044adbcb1a4510fb3cc733
    • Size 1.5MB
    • SHA256 3f3c2d584a904ed976a130b022c037cbc477f620149436971ffe78c1e42e706d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderev6cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks