General

  • Target

    3fc88e57a74c7c133ae634c79f037be3.exe

  • Size

    800KB

  • Sample

    210307-779aqvvsyj

  • MD5

    3fc88e57a74c7c133ae634c79f037be3

  • SHA1

    27726ee6291da5115b6192a72bcf7a1a72b75531

  • SHA256

    99cfc0e79eca01b80f6b466bd9bf208b821e275b3787cb194d0f2b83d6ffe03a

  • SHA512

    b50a44f69bfec3eacf4eca6162d3023deabdd2ae86e149498211a306dfc4a3b2f73f7ceaed3a61a430811f377e0a1502713a845f23fc1cfa26ac6c57e7574ac9

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Targets

    • Target

      3fc88e57a74c7c133ae634c79f037be3.exe

    • Size

      800KB

    • MD5

      3fc88e57a74c7c133ae634c79f037be3

    • SHA1

      27726ee6291da5115b6192a72bcf7a1a72b75531

    • SHA256

      99cfc0e79eca01b80f6b466bd9bf208b821e275b3787cb194d0f2b83d6ffe03a

    • SHA512

      b50a44f69bfec3eacf4eca6162d3023deabdd2ae86e149498211a306dfc4a3b2f73f7ceaed3a61a430811f377e0a1502713a845f23fc1cfa26ac6c57e7574ac9

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks