Overview

overview

10

Static

static

3

6a648e7882...05.exe

windows7-x64

10

6a648e7882...05.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6a648e78826c4e2e6a4c1f984c91cbedadf14344383306d023f4730d481bce05.exe
  • Size 743KB
  • Sample240726-d7jrrsthpl
  • SHA256 6a648e78826c4e2e6a4c1f984c91cbedadf14344383306d023f4730d481bce05
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderhfhfdiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • hfhf

Decoy

  • ddhh9500.com

  • lesterkwilson.store

  • southasianrepublicans.com

  • azumo.xyz

  • emptycc.net

  • lelasthriftboutique.com

  • redis76.com

  • marinebelaroi.com

  • hallibrewerproductions.com

  • elevareassessoria.com

  • haozhugou.com

  • anti-ragebot.com

  • bardo.xyz

  • dryerventmastersllc.com

  • qmhdxu.biz

  • getgoldentoday.com

  • crippledom.com

  • primedispatchers.com

  • 052et.xyz

  • h2adubai.com

Targets

    • Target
      6a648e78826c4e2e6a4c1f984c91cbedadf14344383306d023f4730d481bce05.exe
    • Size 743KB
    • SHA256 6a648e78826c4e2e6a4c1f984c91cbedadf14344383306d023f4730d481bce05
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloaderhfhfdiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks