Overview

overview

10

Static

static

3

9ec36a263e...a5.exe

windows7-x64

10

9ec36a263e...a5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9ec36a263e339b95d1c21ab7234372a5
  • Size 1.5MB
  • Sample240215-2mt9rsbc63
  • SHA256 940ee40d0ea9f6a02abe1f52323341d70a4b5ee4fb8135a1711a45024f927b60
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderbe4oloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • be4o

Decoy

  • gosth-kitchen.com

  • 300coin.club

  • mdseenergys.com

  • weizhong.asia

  • pixorum.com

  • rdchicken.com

  • beverlyhills-mc.com

  • voteelliot.com

  • noithatsongtung.com

  • bestiepetinsurance.net

  • pannacottagames.com

  • materaweddings.com

  • kryodry.com

  • hardlikeaboss.com

  • fnhope.com

  • blun33.com

  • rentmystuff.pro

  • maimaimaoba.com

  • caneteperu.com

  • lata-gouveia.com

Targets

    • Target
      9ec36a263e339b95d1c21ab7234372a5
    • Size 1.5MB
    • SHA256 940ee40d0ea9f6a02abe1f52323341d70a4b5ee4fb8135a1711a45024f927b60
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderbe4oloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks