Overview

overview

10

Static

static

3

PO#00009_PDF.exe

windows7-x64

10

PO#00009_PDF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a4d5f4141239c2a1fc230c47617950e3
  • Size 218KB
  • Sample240225-2586msff61
  • SHA256 dcbd2cde0e9e5457de1d4f0cdb07dbab996ad9ba04396c0ebb08681f4d648009
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderusvrloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • usvr

Decoy

  • theblockmeatstore.com

  • drone-moment.com

  • srsfashionbd.com

  • kylayagerartwork.com

  • instagrams.tools

  • rosenwealth.com

  • indicraftsvilla.com

  • rswizard.com

  • irist.one

  • pubgclaimx14.com

  • thegeorgiahomefinder.com

  • unusualdog.com

  • kifayatikart.com

  • methodunit.net

  • bavarian-luxury.com

  • 17391000.com

  • ipcsaveday.com

  • yael-b.com

  • pasionqueconecta.com

  • youngsvideography.com

Targets

    • Target
      PO#00009_PDF.exe
    • Size 241KB
    • SHA256 6f16d3f4edabb65e90a4d55adfd531ca7b9b04eda32bb1a5c2489ab2e49f0491
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderusvrloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks