Overview

overview

10

Static

static

3

932642be9b...b0.exe

windows7-x64

10

932642be9b...b0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    932642be9bdf1c8c10912ee4a77353b0
  • Size 1.0MB
  • Sample240205-18aa2shfh6
  • SHA256 32892372ea0ea531841d7df51f2351a46d6c0e1e302fe3cd301407d6acd1ed95
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderftgqloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ftgq

Decoy

  • naturalbeautyapparel.com

  • abtotalsolution.com

  • periclescapitalmanagement.com

  • pleasejustdont.com

  • ryanscode.com

  • carsandscooters.com

  • best-polarized-sunglasses.com

  • hoodshawaii.com

  • titaefred.com

  • tomrings.com

  • swededenoting.host

  • birthdaytease.com

  • xaydzn.com

  • scutganxun.com

  • gdzhongle.com

  • alossol.com

  • shivamshield.com

  • fashionnailsjohnston.com

  • jobuelas.com

  • arvopaert.com

Targets

    • Target
      932642be9bdf1c8c10912ee4a77353b0
    • Size 1.0MB
    • SHA256 32892372ea0ea531841d7df51f2351a46d6c0e1e302fe3cd301407d6acd1ed95
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderftgqloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks