General

  • Target
    VrzbgLW535gNZH4.exe
  • Size 599KB
  • Sample210703-k8rm22txcs
  • SHA256 dd759c0f396781dd67e9b31cbb725e88883defe4d10698606ca9f50e1a92ffb2
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

C2
  • http://www.kkkwhitepride.com/66op/

Decoy
  • ttxyzp.com

  • miamivendingservices.com

  • namanhphat.com

  • filmexllc.com

  • snowflakebytes.net

  • qygdance.com

  • small-mart.online

  • libryapp.com

  • guadelouperegistry.net

  • hoodiessport.com

  • tienda-china.com

  • musicergonomy.com

  • yahonatinog.space

  • lvn.xyz

  • aerospace-engineers.com

  • bluemountainbeveragecompany.com

  • thedonationcard.com

  • gigharborcancercare.com

  • restondefencejobs.com

  • alfenafootwear.com

Targets

    • Target
      VrzbgLW535gNZH4.exe
    • Size 599KB
    • SHA256 dd759c0f396781dd67e9b31cbb725e88883defe4d10698606ca9f50e1a92ffb2
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks