Overview

overview

10

Static

static

3

98e06c0360...21.exe

windows7-x64

1

98e06c0360...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    98e06c036043bbc1dc669ea2f1611c21
  • Size 675KB
  • Sample240213-jqf77sec53
  • SHA256 ca4e8b9f939327da017d8625121beeba12321a66ada9d6c65d21a02d8194f3ca
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadert5n8loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • t5n8

Decoy

  • sopheabelle.com

  • brandoncrosss.com

  • oscarpinilla.com

  • nexusbisous.com

  • mmnica.xyz

  • jyomrgw.icu

  • interactivecommons.com

  • aceandarrowboutique.com

  • designtipstricks.com

  • dismerlogistics.com

  • varemodelgulch.com

  • doicard365.com

  • suerickard.com

  • myasovdom.com

  • sulgin.com

  • chadgerman.com

  • valkyrie-teeshirt.com

  • bodycamsforus.com

  • rogueduelisttrade.com

  • suspendthepres.online

Targets

    • Target
      98e06c036043bbc1dc669ea2f1611c21
    • Size 675KB
    • SHA256 ca4e8b9f939327da017d8625121beeba12321a66ada9d6c65d21a02d8194f3ca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadert5n8loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks