Overview

overview

10

Static

static

3

b9b9932c5a...c8.exe

windows7-x64

10

b9b9932c5a...c8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b9b9932c5a7b698cb2d56cdf8b1223c8.bin
  • Size 1.6MB
  • Sample240309-ccwbmsbd64
  • SHA256 bed07b0251d8d888bf2f397fbeca98f581aa8cbea1e460024dd0ecfdb14d0105
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderdt9vloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • dt9v

Decoy

  • scandinavianview.com

  • 120x600businessskyscraper.fail

  • livebigrace.com

  • fussygang.net

  • afiyetmarket.com

  • shopcerygensan.com

  • iregentos.info

  • anidonia.com

  • vtnywvebm.club

  • envcons.com

  • blackpharaohbeards.com

  • shortsnsuits.com

  • digitalvv.com

  • czechagents.com

  • texasadvancedsurgery.com

  • erhob.com

  • fastypro.com

  • singlemomsurvival.com

  • mohitiitr.com

  • airsoftoutlet.store

Targets

    • Target
      b9b9932c5a7b698cb2d56cdf8b1223c8.bin
    • Size 1.6MB
    • SHA256 bed07b0251d8d888bf2f397fbeca98f581aa8cbea1e460024dd0ecfdb14d0105
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderdt9vloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks