Overview

overview

10

Static

static

3

a01ccf9ea1...93.exe

windows7-x64

10

a01ccf9ea1...93.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a01ccf9ea1cd42165dcf68211a819193
  • Size 463KB
  • Sample240216-l7tkzagc6t
  • SHA256 cac5a5a1cd604a792b9231fb65fe38110c631873cfa834bf4f43b9418d1ec17f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderma5cloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ma5c

Decoy

  • hua0591.com

  • ncuedu.icu

  • damaramtv.com

  • mgnmx.com

  • fridaynightdates.com

  • lyqjzg.net

  • americanalecompany.com

  • badgebuttons.com

  • maiketplace.com

  • camsa90.com

  • certifiedrockets.com

  • mixmarkt.delivery

  • htownxtracts.com

  • bluemountainautoparts.com

  • aldemallc.com

  • joint-sisters.com

  • gertimi.com

  • s293a8tx4zu.net

  • healthy-calm.com

  • bulukx.com

Targets

    • Target
      a01ccf9ea1cd42165dcf68211a819193
    • Size 463KB
    • SHA256 cac5a5a1cd604a792b9231fb65fe38110c631873cfa834bf4f43b9418d1ec17f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderma5cloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks