Overview

overview

10

Static

static

3

1131769306...21.exe

windows7-x64

10

1131769306...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7ad7a7ae41b5f19f2d2d6c59bf43620c
  • Size 622KB
  • Sample240127-v2he7agfe7
  • SHA256 31390820ca940a19f0eeaed5b38b27f7cd78317adf40489882b3de038c2ad857
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadern58iloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • n58i

Decoy

  • nl-cafe.com

  • votetedjaleta.com

  • britrobertsrealtor.com

  • globipark.com

  • citysucces.com

  • verisignwebsite-verified.com

  • riddlepc.com

  • rosecityclimbing.com

  • oleandrinextract.com

  • salmankonstruksi.com

  • needhamchannel.com

  • refreshx2z.com

  • youth66.com

  • pla-russia.com

  • halloweenmaskpro.com

  • exdysis.com

  • 1gcz.com

  • lookgoodman.com

  • rlxagva.com

  • stlcityc.com

Targets

    • Target
      11317693065_03162021.exe
    • Size 847KB
    • SHA256 35e50a9d07903f1987a19115dfecdea79cec0844a04883e47106a2969d496ee6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadern58iloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks