Overview

overview

10

Static

static

3

76baa8d35e...86.exe

windows7-x64

10

76baa8d35e...86.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    76baa8d35ea656b972c92c94c8d3fe86
  • Size 757KB
  • Sample240126-h56kzagff2
  • SHA256 6d308c2e93c341ef11c0b14420e158fd650c637190a4daedf003ec091e703a85
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderrqe8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • rqe8

Decoy

  • bjft.net

  • abrosnm3.com

  • badlistens.com

  • signal-japan.com

  • schaka.com

  • kingdompersonalbranding.com

  • sewmenship.com

  • lzproperty.com

  • mojoimpacthosting.com

  • carinsurancecoverage.care

  • corporatemercadona.com

  • mobileswash.com

  • forevercelebration2026.com

  • co-het.com

  • bellesherlou.com

  • commentsoldgolf.com

  • onlytwod.group

  • utesco.info

  • martstrip.com

  • onszdgu.icu

Targets

    • Target
      76baa8d35ea656b972c92c94c8d3fe86
    • Size 757KB
    • SHA256 6d308c2e93c341ef11c0b14420e158fd650c637190a4daedf003ec091e703a85
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderrqe8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks