Overview

overview

10

Static

static

3

56e64ccb7d...d2.exe

windows7-x64

10

56e64ccb7d...d2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    56e64ccb7d80ce3b10d694ec7546a7d2
  • Size 795KB
  • Sample240112-th7qasbhb6
  • SHA256 6d1a2210fa159592e40eaf39ae82d44bac24ddb5df2d64825a40bf58ae09172e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderearzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • earz

Decoy

  • halacoupon.com

  • anthos-labs.com

  • hagertylabs.net

  • l1992.com

  • 856379580.xyz

  • rcbb-technologies.com

  • realhoggapparel.com

  • sauceprince.com

  • tootingcab.com

  • 4chase5.com

  • ordergogibibimbap.com

  • nyj.xyz

  • dermixspa.com

  • premiergiftingco.com

  • razorcentric.com

  • mbrealtyadvisors.com

  • officialjazz.club

  • cctv006.com

  • hbcuatthepolls.info

  • prestamos-ya.com

Targets

    • Target
      56e64ccb7d80ce3b10d694ec7546a7d2
    • Size 795KB
    • SHA256 6d1a2210fa159592e40eaf39ae82d44bac24ddb5df2d64825a40bf58ae09172e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderearzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks