Overview

overview

10

Static

static

3

5622323af4...77.exe

windows7-x64

10

5622323af4...77.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5622323af4bbf2a86a3a324270c72077
  • Size 739KB
  • Sample240112-lweyfaeeb4
  • SHA256 a223dffb9765f637f9f9ecdf980573491065b81d188530cee9961931b3ea59b0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadergno4loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • gno4

Decoy

  • callsecuritymusic.com

  • quikngo.com

  • gardenofbabyclothes.com

  • bailbondinculvercity.com

  • nqyaurlz.icu

  • sultanulhind.com

  • toddy-bodies.com

  • kom-hunter.com

  • theradibio.com

  • pageonefourplay.info

  • wildlifetools.com

  • nobleegoist.com

  • girlsjerkoff.com

  • theenlows.com

  • jyqcxl.com

  • southernbluebee.com

  • betfootballthaigold.com

  • remaxaffinityplus.net

  • teamlunsford.com

  • howtoberealonline.com

Targets

    • Target
      5622323af4bbf2a86a3a324270c72077
    • Size 739KB
    • SHA256 a223dffb9765f637f9f9ecdf980573491065b81d188530cee9961931b3ea59b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadergno4loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks