Overview

overview

10

Static

static

3

czOxHskgIAQwZ8m.exe

windows7-x64

3

czOxHskgIAQwZ8m.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6048d2cc24be326d2ede052bb52c19fa.zip
  • Size 386KB
  • Sample240831-bzerqsyale
  • SHA256 2ea5c66405be0aa4503f7379be6c3520afd5f82784571825fb5032c96d59397c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderamb4discoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • amb4

Decoy

  • ameerkabob.com

  • wenzhikeji.online

  • ktnsoil.xyz

  • dock7rods.com

  • simbaimmigration.com

  • tanahvilamalino.online

  • amaozn-co-jp.xyz

  • atahukukbafra.com

  • attruth.net

  • jigservices.net

  • 310indianway.com

  • freelotto.online

  • mylanding-page.com

  • dudemealprep.com

  • wellmaintainedhealth.com

  • vitemonprenom.com

  • laurynfauntroy.com

  • pilotmom.info

  • arpatientsapp.com

  • sendangdigital.com

Targets

    • Target
      czOxHskgIAQwZ8m.exe
    • Size 425KB
    • SHA256 856b8775a8063900378a815cd03d0f9628c4296eddd93ac9e9cd52269178c079
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryxloaderamb4loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks