Overview

overview

10

Static

static

3

6e77fe0eb2...69.exe

windows7-x64

10

6e77fe0eb2...69.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6e77fe0eb26c4834a5411e66a78a3e69
  • Size 859KB
  • Sample240122-cwajaaechp
  • SHA256 fbeb9b62ff737a87fe38709d075f3fee34502b01262480cf5a014efaab4f7075
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadercogtloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • cogt

Decoy

  • britechsoft.com

  • vitortedeschi.com

  • nittwittridge.net

  • nblianger.com

  • fs133.net

  • theprairiesky.com

  • mylexinova.com

  • loveiscomingbook.com

  • thehouseoflightning.com

  • gulbahorfoodblogger.online

  • exploringanddiscovering.com

  • edyscleaning.com

  • jihalbroskorea.com

  • sammys-cafe.com

  • smallbluer.com

  • voglioincontri.com

  • aaareplicamall.com

  • empireofglam.com

  • 4hu5555.com

  • cookiescalofornia.com

Targets

    • Target
      6e77fe0eb26c4834a5411e66a78a3e69
    • Size 859KB
    • SHA256 fbeb9b62ff737a87fe38709d075f3fee34502b01262480cf5a014efaab4f7075
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadercogtloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks