Overview

overview

10

Static

static

1

de0aa0304f...78.exe

windows7_x64

10

de0aa0304f...78.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    de0aa0304f6880c7263d35fc7d487278.exe
  • Size 245KB
  • Sample220125-nc6cdsfah2
  • SHA256 a58fa4c9cd9960a9b7c8fbab4942b3d1f28035ce37b68b4835afa9e728cbdc0a
  • MD5 SHA1 SHA512
Score
10/10
xloaderjdo2loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • jdo2

Decoy

  • adopte-un-per.com

  • lmandarin.com

  • shonemurawni.quest

  • bantasis.com

  • jsdigitalekuns.net

  • hiddenroom.net

  • arungjerampangalengan.com

  • yinghongxw.com

  • buzzcupid.com

  • lattent.digital

  • faxtoemailguide.com

  • romanticfriryrose.com

  • ruleaou.com

  • mochiko-blog.com

  • sekireixploit.com

  • bcx-wiremesh.com

  • jobportalsg.com

  • wysspirit.com

  • iflycny.com

  • sh-cy17.com

Targets

    • Target
      de0aa0304f6880c7263d35fc7d487278.exe
    • Size 245KB
    • SHA256 a58fa4c9cd9960a9b7c8fbab4942b3d1f28035ce37b68b4835afa9e728cbdc0a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderjdo2loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks