Overview

overview

10

Static

static

3

52bbf5ae0d...74.exe

windows7-x64

10

52bbf5ae0d...74.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    52bbf5ae0d8263bb459d51ee2372ff74
  • Size 1.1MB
  • Sample240111-gr2t7abcf3
  • SHA256 7501983d0d78672e0a4274786542b09506c9f94a88b597aefb87e0357c775ae3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloader6mamloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • 6mam

Decoy

  • gxduoke.com

  • lawmetricssolicitors.com

  • e-bizbox.com

  • ilovemehoodie.com

  • marcuslafond.com

  • bransolute.com

  • kuppers.info

  • kykyryky.art

  • vavasoo.com

  • tlamj.com

  • besport24.com

  • hibachiexpressnctogo.com

  • elglink99.com

  • maximos.world

  • uniamaa.com

  • aladinfarma.com

  • opticatervisof.com

  • delhibudokankarate.com

  • juliekifyukstyle.com

  • fuzhourexian.com

Targets

    • Target
      52bbf5ae0d8263bb459d51ee2372ff74
    • Size 1.1MB
    • SHA256 7501983d0d78672e0a4274786542b09506c9f94a88b597aefb87e0357c775ae3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloader6mamloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks