Overview

overview

10

Static

static

3

Remittance advice.exe

windows7-x64

10

Remittance advice.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    583728b5f8153a80b3327b3ac579d17e
  • Size 309KB
  • Sample240113-g86jpsebg6
  • SHA256 78adbda6236e7a83a2e9507bc8d3a37efa2c5b7a4fcf215e08fa5726ac0731be
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderzy38loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • zy38

Decoy

  • legacywritersacademy.net

  • globalforum-tm.com

  • jeffmackeyforjudge.com

  • lakenwatersports.gallery

  • zsgpbgsbh.icu

  • dwarkaluxuryhome.com

  • h7n9supply.com

  • findfromusstore.com

  • hemp8pharm.com

  • usacybersec.com

  • expressir.net

  • teknikfolyo.com

  • redlacedigital.com

  • tinhaynhat.com

  • social808.com

  • tecnoscript.com

  • mrsboddiesboutique.com

  • sjplot.com

  • soyo283.com

  • jayciedavid.com

Targets

    • Target
      Remittance advice.exe
    • Size 252KB
    • SHA256 657cab120187572696f7c42467fa8f996cba9a26c0a0583c528f49dc147823e5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderzy38loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks