Overview

overview

10

Static

static

3

638b6ebd15...d7.exe

windows7-x64

10

638b6ebd15...d7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    638b6ebd151367c3edb3c71446f69dd7
  • Size 832KB
  • Sample240117-zds91aegd7
  • SHA256 fd151f1c914b41e565c1dfeae2cab5c77fdcc885b83c46e30b9fe3eefc68efd3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadergno4loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • gno4

Decoy

  • callsecuritymusic.com

  • quikngo.com

  • gardenofbabyclothes.com

  • bailbondinculvercity.com

  • nqyaurlz.icu

  • sultanulhind.com

  • toddy-bodies.com

  • kom-hunter.com

  • theradibio.com

  • pageonefourplay.info

  • wildlifetools.com

  • nobleegoist.com

  • girlsjerkoff.com

  • theenlows.com

  • jyqcxl.com

  • southernbluebee.com

  • betfootballthaigold.com

  • remaxaffinityplus.net

  • teamlunsford.com

  • howtoberealonline.com

Targets

    • Target
      638b6ebd151367c3edb3c71446f69dd7
    • Size 832KB
    • SHA256 fd151f1c914b41e565c1dfeae2cab5c77fdcc885b83c46e30b9fe3eefc68efd3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadergno4loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks