Overview

overview

10

Static

static

3

d24fc8737f...36.exe

windows7-x64

10

d24fc8737f...36.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d24fc8737f2e7f453fe3688ac4c39736
  • Size 1.4MB
  • Sample240318-ckwx5sdh56
  • SHA256 f554af43cf1397d00309fdb967a62a825f4cf06100bab5e8fff17a9faa56d0f7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderearzloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • earz

Decoy

  • halacoupon.com

  • anthos-labs.com

  • hagertylabs.net

  • l1992.com

  • 856379580.xyz

  • rcbb-technologies.com

  • realhoggapparel.com

  • sauceprince.com

  • tootingcab.com

  • 4chase5.com

  • ordergogibibimbap.com

  • nyj.xyz

  • dermixspa.com

  • premiergiftingco.com

  • razorcentric.com

  • mbrealtyadvisors.com

  • officialjazz.club

  • cctv006.com

  • hbcuatthepolls.info

  • prestamos-ya.com

Targets

    • Target
      d24fc8737f2e7f453fe3688ac4c39736
    • Size 1.4MB
    • SHA256 f554af43cf1397d00309fdb967a62a825f4cf06100bab5e8fff17a9faa56d0f7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderearzloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks