General

  • Target
    Order.exe
  • Size 732KB
  • Sample210610-smdfke7hee
  • SHA256 73e5b50b261f0d3f8e31c4cd387f86be97b206b9a5cda3dfe0122618bce85151
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

C2
  • http://www.generalplex.com/pz9b/

Decoy
  • gochili.info

  • cyberdatadefence.com

  • payonbux.com

  • candiceswanepoelbrasil.com

  • mykaoa.com

  • tanabe-kanagu.com

  • dovetailgoodlife.xyz

  • alabasterautomotive.com

  • tajc.club

  • authwdqtsi6sojynof9gmazon.com

  • cookingguides.net

  • yah360.com

  • berriq.com

  • freetoreview.online

  • yachtsgoneonline.com

  • clothestokidsri.com

  • howtogetstartedwithfba.com

  • simplepartyplanning.com

  • sunrisekai.com

  • wealthfarmer.net

Targets

    • Target
      Order.exe
    • Size 732KB
    • SHA256 73e5b50b261f0d3f8e31c4cd387f86be97b206b9a5cda3dfe0122618bce85151
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks