Overview

overview

10

Static

static

3

597c47748b...92.exe

windows7-x64

10

597c47748b...92.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    597c47748b3248690d79182a654fb392.bin
  • Size 246KB
  • Sample240115-ctsbbageb5
  • SHA256 fc6d7cb3e579d7679e90cd2d4d9f4ec608af59a88e822104c0514079e705d004
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderuo4xloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • uo4x

Decoy

  • justinlocke.design

  • integrauy.com

  • veganoandorganico.com

  • solisdq.info

  • kitchentoolhouse.com

  • essencejanay.com

  • faithfultruck.com

  • marketplace-73837233.com

  • bimadesigns.com

  • confussekd.com

  • aadamslovingheart.com

  • abdulsalamyafi.com

  • leticiamagalhaes.science

  • myrootsandtrees.com

  • thewickedwafflestick.com

  • wanakamotelnz.com

  • driveerb.com

  • trenchng.com

  • tarantocapitaledimare.info

  • vipmallorcamanagement.com

Targets

    • Target
      597c47748b3248690d79182a654fb392.bin
    • Size 246KB
    • SHA256 fc6d7cb3e579d7679e90cd2d4d9f4ec608af59a88e822104c0514079e705d004
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderuo4xloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks