General

  • Target
    ORDER LIST.pdf.exe
  • Size 708KB
  • Sample210527-b4xchehdcs
  • SHA256 58b7fa527ab5cff6d5465f2e751854e6708ef4d0070587883ca1fd8739359d6d
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

C2
  • http://www.kalptarucentrino.com/owws/

Decoy
  • asahizushi.info

  • 691jxy.com

  • richelitesingles.com

  • traditionalmehandi.com

  • germinatebio.com

  • 568215.com

  • yds-inc.com

  • whirlpool-repair.site

  • alwaysincerely.com

  • themallvideo.com

  • hzzamy.com

  • merchasylum.net

  • weknownorthgower.com

  • zseasyfishin.com

  • corporaterecruitertraining.com

  • pheki.com

  • kaqitoy.com

  • pbzb94.com

  • cortopepperfest.com

  • texas956.com

Targets

    • Target
      ORDER LIST.pdf.exe
    • Size 708KB
    • SHA256 58b7fa527ab5cff6d5465f2e751854e6708ef4d0070587883ca1fd8739359d6d
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks