Overview

overview

10

Static

static

3

RFQ Rosemount.exe

windows7-x64

10

RFQ Rosemount.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    66620284ba61a3f8c2c5f4ed7dd8e7cb
  • Size 1.2MB
  • Sample240119-ab3m8aafb2
  • SHA256 3c739358220734d18edf97e09acdb0ef93b835f96c31dcbcb7ad86a5198e0b12
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderp596loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • p596

Decoy

  • ushistorical.com

  • lovepropertylondon.com

  • acupress-the-point.com

  • 3772548.com

  • ambientabuse.com

  • primaveracm.com

  • themidwestmomblog.com

  • havasavunma.com

  • rockyroadbrand.com

  • zzphys.com

  • masque-inclusif.com

  • myeonyeokplus.com

  • linkernet.pro

  • zezirma.com

  • mysiniar.com

  • andreamall.com

  • mattesonauto.com

  • wandopowerinc.com

  • casaurgence.com

  • salishseaquilts.com

Targets

    • Target
      RFQ Rosemount.exe
    • Size 1.3MB
    • SHA256 5d73a302ff09dd9d39420703dc50c9530ac6e78b55c762f9c03df76be39d6c2c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderp596loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks