General

  • Target

    7b6e0668659b20f30bdf81025247a199.exe

  • Size

    218KB

  • Sample

    210304-a7sezm34xa

  • MD5

    7b6e0668659b20f30bdf81025247a199

  • SHA1

    27f1e8665c5423b43a5ad11a7d3762c539fbef9c

  • SHA256

    34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d

  • SHA512

    62b1bb025e1ba2969dbed85c6c96ef4f0c78fc9c58db4442c441f70a6587e9e3421717c67c12ffd95f0e7347b941fd389cadc97be4cac612e02f71388e2e05b4

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Targets

    • Target

      7b6e0668659b20f30bdf81025247a199.exe

    • Size

      218KB

    • MD5

      7b6e0668659b20f30bdf81025247a199

    • SHA1

      27f1e8665c5423b43a5ad11a7d3762c539fbef9c

    • SHA256

      34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d

    • SHA512

      62b1bb025e1ba2969dbed85c6c96ef4f0c78fc9c58db4442c441f70a6587e9e3421717c67c12ffd95f0e7347b941fd389cadc97be4cac612e02f71388e2e05b4

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks