Overview

overview

10

Static

static

NEW QUOTAT...ST.exe

windows7_x64

10

NEW QUOTAT...ST.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NEW QUOTATION REQUEST.exe
  • Size 533KB
  • Sample220401-radfdacdd4
  • SHA256 ac35cec2587a18dcd2be9da436cf76376c8b52de1b3637f1eee9490b227ba08a
  • MD5 SHA1 SHA512
Score
10/10
xloaderpg3oloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • pg3o

Decoy

  • thelostrose.com

  • liebemadchen4u.art

  • scuzzfest.com

  • labalhadi.com

  • ecran-thermique.com

  • explorepanel.com

  • smdledneonflex.com

  • jpstandardcompany.net

  • gunspatrol.com

  • dugerits.com

  • asquaredlegalgroup.com

  • sasha-media.com

  • praconsultingandinspection.com

  • awaisqarni.com

  • paysology.com

  • terradr.one

  • lorebeasts.com

  • mapiadventuretour.com

  • dietatrintadias.com

  • powerether.online

Targets

    • Target
      NEW QUOTATION REQUEST.exe
    • Size 533KB
    • SHA256 ac35cec2587a18dcd2be9da436cf76376c8b52de1b3637f1eee9490b227ba08a
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderpg3oloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks