Overview

overview

10

Static

static

Shipping d...04.exe

windows7_x64

10

Shipping d...04.exe

windows10-2004_x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    Shipping documents for PO 810884,810904.exe
  • Size 467KB
  • Sample220119-lbbqaagfa6
  • SHA256 ce53a88fb28e7708bc7eae3494d020093cb81e1a15c57713db1d755b2fb7baf5
  • MD5 SHA1 SHA512
Score
10/10
xloaderm4roloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m4ro

Decoy

  • schedulekeymail.com

  • ruteglobe.net

  • makspeed.online

  • legalsoftsolutions.info

  • sportdemands.com

  • ci-ohio.com

  • ge-endoscopy.com

  • edp7.com

  • teammississippistate.club

  • risingrecovery.info

  • shouldimint.com

  • haxeo0d1wo.com

  • tjxinglin.com

  • immigrationformsus.com

  • best-free-soccer-academy.com

  • iamvitalessence.com

  • hellranch.net

  • creamydickmail.com

  • standshopping.com

  • slayhernail.com

Targets

    • Target
      Shipping documents for PO 810884,810904.exe
    • Size 467KB
    • SHA256 ce53a88fb28e7708bc7eae3494d020093cb81e1a15c57713db1d755b2fb7baf5
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm4roloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks