General

  • Target

    ad72eed1325274987532a72ccd525d4e.exe

  • Size

    515KB

  • Sample

    210306-45nssb5a2s

  • MD5

    ad72eed1325274987532a72ccd525d4e

  • SHA1

    1ce9c2bbcae7bfb016e3ee28f61a033c70ffa561

  • SHA256

    0e23e210b0a781a42bf7f5fcf1cc95b888c1230c819fe7134f04048a36706124

  • SHA512

    650b8060fad21f2ee522d6068f6552fc46cab5f9752bc5f2877bd5b5f19d8b1848d075c1c13da2b2e73227a1be49c85c6df7dcbe579128a25fd25973d917cf88

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Targets

    • Target

      ad72eed1325274987532a72ccd525d4e.exe

    • Size

      515KB

    • MD5

      ad72eed1325274987532a72ccd525d4e

    • SHA1

      1ce9c2bbcae7bfb016e3ee28f61a033c70ffa561

    • SHA256

      0e23e210b0a781a42bf7f5fcf1cc95b888c1230c819fe7134f04048a36706124

    • SHA512

      650b8060fad21f2ee522d6068f6552fc46cab5f9752bc5f2877bd5b5f19d8b1848d075c1c13da2b2e73227a1be49c85c6df7dcbe579128a25fd25973d917cf88

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks