Overview

overview

10

Static

static

3

05169db7f1...56.exe

windows7-x64

10

05169db7f1...56.exe

windows10-2004-x64

7

mlkdtrqkv.exe

windows7-x64

3

mlkdtrqkv.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    05169db7f1ffd49e6ed73d6d55db576bcd1a89615588f1a2713af98e8f860456
  • Size 307KB
  • Sample241121-ymjaqawkfv
  • SHA256 05169db7f1ffd49e6ed73d6d55db576bcd1a89615588f1a2713af98e8f860456
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloadernv0adiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • nv0a

Decoy

  • creativehomesrealty.com

  • hairshopamity.com

  • karunahotyoga.com

  • indialowfare.com

  • abdulnazar.com

  • art-handmade.com

  • videofx.store

  • onboard-alt-digital-avg.rest

  • lipe-engineering.com

  • arthurchatfield.com

  • keencloset.com

  • jsyonghui.com

  • hangwei.tech

  • price-hype.com

  • rlandislnteriors.com

  • junewilderwrites.com

  • dazhongwenzhai.com

  • tsnefise17.xyz

  • 2ndmobi.com

  • natemerritt.com

Targets

    • Target
      05169db7f1ffd49e6ed73d6d55db576bcd1a89615588f1a2713af98e8f860456
    • Size 307KB
    • SHA256 05169db7f1ffd49e6ed73d6d55db576bcd1a89615588f1a2713af98e8f860456
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xloadernv0adiscoveryloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader family

      xloader

    • Xloader payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      mlkdtrqkv.exe
    • Size 117KB
    • SHA256 b12d7fb5370439771f33b99428d12979d59c1d2aff56eb572294e7fd2a7c05d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks