Overview

overview

10

Static

static

3

9bbc8e65a2...2c.exe

windows7-x64

10

9bbc8e65a2...2c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9bbc8e65a25b02bde1d5fd76fdf60a2c
  • Size 1.1MB
  • Sample240214-p8fx2scd33
  • SHA256 1295e1c1f0b45bbb1d073017310116206eecb37d95bd447cf11e01f44c3fe4c6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderowwsloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • owws

Decoy

  • mytestin.com

  • thenakedjoypodcast.com

  • elsegundotequilabar.com

  • thefurryfriendsplace.com

  • sitowebcasavacanze.com

  • satellitepublishing.com

  • lowdownsports.net

  • angelsvideoproductions.com

  • bair-er.com

  • abilitycapitalpartners.com

  • bestmultifunctiontool.com

  • bloghappness.com

  • xn--xhq99jp6i75j.com

  • obxhwy12.com

  • dematoffer.com

  • ladderuptoday.com

  • christianipitts.com

  • shakambaricottons.com

  • dondelivery.net

  • ibextravetrailers.net

Targets

    • Target
      9bbc8e65a25b02bde1d5fd76fdf60a2c
    • Size 1.1MB
    • SHA256 1295e1c1f0b45bbb1d073017310116206eecb37d95bd447cf11e01f44c3fe4c6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderowwsloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks