Overview

overview

10

Static

static

3

9eb9ce6fa8...85.exe

windows7-x64

10

9eb9ce6fa8...85.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    9eb9ce6fa80e866fccb277b400033685
  • Size 517KB
  • Sample240215-2ch4raba38
  • SHA256 d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderubqxloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ubqx

Decoy

  • missingounces.com

  • lanjay.com

  • whizbets.com

  • maltaprefix.icu

  • vmatranslations.com

  • nuno-hh.com

  • dxcsmm.com

  • maxirnintegrated.com

  • jpavwa.com

  • shieldsvalleyrancher.com

  • chennaimarketplace.store

  • onlineordersecrets.com

  • missysluxuryhairbundles.com

  • olmtopst.info

  • abcbooch.com

  • aycarcarrental.com

  • firsttexassubaru.com

  • lessstuffmorestory.com

  • nassausbestroofers.com

  • j976.net

Targets

    • Target
      9eb9ce6fa80e866fccb277b400033685
    • Size 517KB
    • SHA256 d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderubqxloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks