Overview

overview

10

Static

static

3

776df245d4...e2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    776df245d497af81c0e57fb7ef763c8b08a623ea044da9d79aa3b381192f70e2.7z
  • Size 308KB
  • Sample260901-y21tbaef39
  • SHA256 11188cf3e0257bfd1719e939a71fab6280c92bd2f246675ade3fd1c641c528ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xloaderxzesdiscoveryloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • xzes

Decoy

  • dent-works.com

  • theravewizards.com

  • venkataramanagraphics.com

  • overway.store

  • alignatura.com

  • boggbogs.com

  • senerants.tech

  • muintel.net

  • bestplacementconsultancy.com

  • trippresso.com

  • communication.services

  • xn--maraaestudio-dhb.com

  • beandhira.com

  • lochnas.com

  • update-mind.com

  • cpcacursos.com

  • metaverse-coaching.com

  • skindefense5.com

  • distressedthenblessed.com

  • alphaore.com

Targets

    • Target
      776df245d497af81c0e57fb7ef763c8b08a623ea044da9d79aa3b381192f70e2.exe
    • Size 564KB
    • SHA256 776df245d497af81c0e57fb7ef763c8b08a623ea044da9d79aa3b381192f70e2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    xzesdiscoveryxloaderloaderrat

    • Family: Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks