Overview

overview

10

Static

static

3

b7b36dcfea...ff.exe

windows7-x64

10

b7b36dcfea...ff.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b7b36dcfeaad538bd9415018cdfc24ff
  • Size 1.3MB
  • Sample240306-shbgesba48
  • SHA256 da53dee3043507717691fb915e4600225eb03cbedb44cd17324c8cd916ccd176
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderogpoloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • ogpo

Decoy

  • ctluxurypropinternational.com

  • mortgagenewsdailt.com

  • diegofragnaud.info

  • marthapollackesq.com

  • thirtynightstay.com

  • sschospitalbardoli.com

  • plaquitasparamascota.com

  • keochatluong.com

  • 420rankings.com

  • westwoodstorageco.com

  • valdobbiadeneinlove.com

  • the427group.com

  • cartercavanaugh.com

  • ivvitaminsofarizona.com

  • ummemunira.com

  • amplifierconsulting.net

  • spk-sakuranomiya.com

  • anjanaonline.com

  • kalibriya.com

  • baincot.com

Targets

    • Target
      b7b36dcfeaad538bd9415018cdfc24ff
    • Size 1.3MB
    • SHA256 da53dee3043507717691fb915e4600225eb03cbedb44cd17324c8cd916ccd176
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderogpoloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks