Overview

overview

10

Static

static

3

66749905f3...58.exe

windows7-x64

10

66749905f3...58.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    66749905f33d0e8b4d145da445af4258
  • Size 893KB
  • Sample240119-a2kkbscbb2
  • SHA256 58dfb633f9d7dab1d15db682a01155b85b36d1190075fcbc5a4d06a7331df77e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderrqe8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • rqe8

Decoy

  • bjft.net

  • abrosnm3.com

  • badlistens.com

  • signal-japan.com

  • schaka.com

  • kingdompersonalbranding.com

  • sewmenship.com

  • lzproperty.com

  • mojoimpacthosting.com

  • carinsurancecoverage.care

  • corporatemercadona.com

  • mobileswash.com

  • forevercelebration2026.com

  • co-het.com

  • bellesherlou.com

  • commentsoldgolf.com

  • onlytwod.group

  • utesco.info

  • martstrip.com

  • onszdgu.icu

Targets

    • Target
      66749905f33d0e8b4d145da445af4258
    • Size 893KB
    • SHA256 58dfb633f9d7dab1d15db682a01155b85b36d1190075fcbc5a4d06a7331df77e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderrqe8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks