General

  • Target
    RFQ_R4100131210.pdf.exe
  • Size 624KB
  • Sample210420-22fhrzedge
  • SHA256 414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

C2
  • http://www.huamxvcyq.icu/aepn/

Decoy
  • noesos.com

  • partsus.xyz

  • manageordercentersupp.com

  • wickedwallart.com

  • hike4cash.com

  • theviragocircle.com

  • followthesharks.com

  • paradisevalleywines.com

  • unmetrolimpio.com

  • eurocarsnj.com

  • alvaroeliseo.com

  • bfc8.xyz

  • oldcourts.com

  • bkpef.info

  • mammately.com

  • agentcharles.com

  • wwwmichiganbulb.com

  • pensolid.info

  • hibiscushealthcare.com

  • mwanakbk.com

Targets

    • Target
      RFQ_R4100131210.pdf.exe
    • Size 624KB
    • SHA256 414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks