Overview

overview

10

Static

static

2t9KtoR9xzpJY4E.exe

windows7_x64

10

2t9KtoR9xzpJY4E.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2t9KtoR9xzpJY4E.exe
  • Size 836KB
  • Sample220127-rxexqaega2
  • SHA256 f79592d7f8ba73cf16c31b3ac92427cdf99789a3eece4c873d0522b3429a783f
  • MD5 SHA1 SHA512
Score
10/10
xloadercbgoloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • cbgo

Decoy

  • tablescaperendezvous4two.net

  • abktransportllc.net

  • roseevision.com

  • skategrindingwheels.com

  • robux-generator-free.xyz

  • yacusi.com

  • mgav35.xyz

  • paravocecommerce.com

  • venkatramanrm.com

  • freakyhamster.com

  • jenaashoponline.com

  • dmozlisting.com

  • lorrainekclark.store

  • handyman-prime.com

  • thecrashingbrains.com

  • ukpms.com

  • livingstonemines.com

  • papeisonline.com

  • chrisbakerpr.com

  • omnipets.store

Targets

    • Target
      2t9KtoR9xzpJY4E.exe
    • Size 836KB
    • SHA256 f79592d7f8ba73cf16c31b3ac92427cdf99789a3eece4c873d0522b3429a783f
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadercbgoloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks