Overview

overview

10

Static

static

Quote orde...99.exe

windows7_x64

10

Quote orde...99.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quote order#098799.exe
  • Size 442KB
  • Sample220202-se2jfaagb3
  • SHA256 f15c18a5596a13ab928dbccd98de41e3501184cc04c1c194ce2c2d3d20e0cb55
  • MD5 SHA1 SHA512
Score
10/10
xloaderm4roloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • m4ro

Decoy

  • schedulekeymail.com

  • ruteglobe.net

  • makspeed.online

  • legalsoftsolutions.info

  • sportdemands.com

  • ci-ohio.com

  • ge-endoscopy.com

  • edp7.com

  • teammississippistate.club

  • risingrecovery.info

  • shouldimint.com

  • haxeo0d1wo.com

  • tjxinglin.com

  • immigrationformsus.com

  • best-free-soccer-academy.com

  • iamvitalessence.com

  • hellranch.net

  • creamydickmail.com

  • standshopping.com

  • slayhernail.com

Targets

    • Target
      Quote order#098799.exe
    • Size 442KB
    • SHA256 f15c18a5596a13ab928dbccd98de41e3501184cc04c1c194ce2c2d3d20e0cb55
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderm4roloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks