Overview

overview

10

Static

static

3

2026-05-06...er.exe

windows10-2004-x64

3

2026-05-06...er.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-06_7f928aabe6a73c95be3bead29799f0a6_elex_luca-stealer_njrat_smoke-loader
  • Size 450KB
  • Sample260506-jbmrfacx7v
  • SHA256 aa9c1766f28ecb098cef5e3e455b513c3411192fcf2a4a9e8a013d3e3b321237
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xloaderqb4adiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • qb4a

Decoy

  • travelsonabike2.net

  • eurekaprice.com

  • bkardd.com

  • vr893.com

  • nnsxykj.com

  • q-p.info

  • 691485.com

  • magixe.com

  • frankysfurnituregallery.com

  • businessloansug.com

  • rocketcompaniesshady.info

  • lercoantincenti.com

  • pelosi4never.com

  • bide168.com

  • socialsecuritybonds.com

  • xn--hy1bj7gtvmh9a15t.com

  • anjaschaefer.net

  • wickedfavicon.com

  • bitesizedstudio.com

  • ecogiftsuk.com

Targets

    • Target
      2026-05-06_7f928aabe6a73c95be3bead29799f0a6_elex_luca-stealer_njrat_smoke-loader
    • Size 450KB
    • SHA256 aa9c1766f28ecb098cef5e3e455b513c3411192fcf2a4a9e8a013d3e3b321237
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryqb4axloaderloaderrat

    • Family: Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks