General

  • Target
    MACHINE SPECIFICATION.exe
  • Size 141KB
  • Sample210322-dsytqpfncx
  • SHA256 fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

C2
  • http://www.dubainights.net/rrrq/

Decoy
  • sdlcutps.com

  • novieffendi.com

  • highpointedu.com

  • sagaming.today

  • charlottesteer.com

  • kilopapa.net

  • prime-executive.com

  • 8893270.com

  • gorillaikka.com

  • coynesgastropub.com

  • sun9376.xyz

  • coolkilo.com

  • 1clickdoc.online

  • fosa.info

  • smileburgerdelivery.com

  • ronpaulmessge17.com

  • sqwigs.com

  • xn--c1ajbkdnb9b0g.xn--p1acf

  • gelzers.info

  • banpluspay.com

Targets

    • Target
      MACHINE SPECIFICATION.exe
    • Size 141KB
    • SHA256 fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks