Overview

overview

10

Static

static

3

93366adf8e...81.exe

windows7-x64

10

93366adf8e...81.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    93366adf8e19c623838e82a9ba9a4c81
  • Size 483KB
  • Sample240205-2tjfvaabg2
  • SHA256 dc86bed9797b57c00ce2cd7840954539f419475fb2bf9aacf577901acba82fdd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderp086loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • p086

Decoy

  • jinshichain.com

  • worldpettraveler.com

  • hightecforpc.com

  • kj97fm.com

  • streetnewstv.com

  • webrew.club

  • wheretogodubai.com

  • apostapolitica.net

  • thecafy.com

  • vinelosangeles.com

  • gashinc.com

  • gutitout.net

  • bvd-invest.com

  • realtoroutdesk.com

  • lawnbowlstournaments.net

  • nobodyisillegal.com

  • abogadoorihuela.net

  • sanistela.com

  • jksecurityworld.com

  • peppermintproject.com

Targets

    • Target
      93366adf8e19c623838e82a9ba9a4c81
    • Size 483KB
    • SHA256 dc86bed9797b57c00ce2cd7840954539f419475fb2bf9aacf577901acba82fdd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderp086loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks