Overview

overview

10

Static

static

3

590c807029...a3.exe

windows7-x64

10

590c807029...a3.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    590c80702966f4024d6085f8927df3a3
  • Size 315KB
  • Sample240113-sq683acdb7
  • SHA256 6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadercre4loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • cre4

Decoy

  • namirani.com

  • winnerscircleapparel.com

  • blackgoldranchoutfitters.com

  • absintheshopping.com

  • billionairetaste.com

  • weida15.com

  • clubsibaritas.com

  • bitmonarch.com

  • xo-car.com

  • terreo.info

  • anymore.one

  • sundarbanstore.com

  • blueshoediaries.com

  • fastloansflorida.com

  • streamzone300.xyz

  • mspxzx.com

  • dailydefileader.com

  • wildblissboutique.com

  • museumsalive.com

  • theeverscholar.com

Targets

    • Target
      590c80702966f4024d6085f8927df3a3
    • Size 315KB
    • SHA256 6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadercre4loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks