Overview

overview

10

Static

static

3

948dcb6334...95.exe

windows7-x64

10

948dcb6334...95.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    948dcb6334b9c25690669df895288c95
  • Size 1.3MB
  • Sample240206-nbtxzageam
  • SHA256 ed748db680d16877716a19b4b09070d0042de28823b96171377d8a06015219c5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadera0celoaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • a0ce

Decoy

  • chennaiprintshop.com

  • criminallawbd.com

  • www140800.com

  • southernleaflounge.com

  • moderngypsydesignlabs.com

  • bioarmourtech.com

  • simplyalina.com

  • picnicdepot.com

  • peshawarsc.com

  • innovativecustomcabinetry.com

  • fzju-ovrzw.xyz

  • 63mews.com

  • giovannitarga.com

  • modernofficeaccessories.com

  • a2zpetcare.net

  • online-nb.com

  • brateix.info

  • bosc.pro

  • xcarethospitality.com

  • sedulabs.com

Targets

    • Target
      948dcb6334b9c25690669df895288c95
    • Size 1.3MB
    • SHA256 ed748db680d16877716a19b4b09070d0042de28823b96171377d8a06015219c5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadera0celoaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks