General

  • Target

    47fa27443cb1abe987ca9f653754b6d0

  • Size

    694KB

  • Sample

    210826-aylkrz2rms

  • MD5

    47fa27443cb1abe987ca9f653754b6d0

  • SHA1

    886a56f419a6e4bc65c603089ee9e9d4f6ad7a54

  • SHA256

    a9010421ea97c10ab6147e6c5077fab296030b13c26b6645502b6165e2e9d4db

  • SHA512

    7dd0b2d5a3716a7ea88f4ca621dc55ec5e3d8a7111e3f373d4631dcdb17c858753e2c55e1723e8c16501ba0d86cc2778cb01bf3ffb791563aa014ef94142e4ac

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ecuu

C2

http://www.polaritelibrairie.com/ecuu/

Decoy

buoy8boats.com

tomrings.com

o-distribs.com

majesticgroupinc.com

tehridam.com

yzwjtoys.com

castro-online.run

aquarius-twins.com

jamesrrossfineart.com

pavarasupatthonkol.com

rivermarketdentistry.com

gyiblrjd.icu

redcountrypodcast.com

youngbrotherspharmacyga.com

betsysobiech.com

neocleanpro.com

ingpatrimoine.com

mustangsallytransportation.com

jsvfcxzn.com

krsfpjuoekcd.info

Targets

    • Target

      47fa27443cb1abe987ca9f653754b6d0

    • Size

      694KB

    • MD5

      47fa27443cb1abe987ca9f653754b6d0

    • SHA1

      886a56f419a6e4bc65c603089ee9e9d4f6ad7a54

    • SHA256

      a9010421ea97c10ab6147e6c5077fab296030b13c26b6645502b6165e2e9d4db

    • SHA512

      7dd0b2d5a3716a7ea88f4ca621dc55ec5e3d8a7111e3f373d4631dcdb17c858753e2c55e1723e8c16501ba0d86cc2778cb01bf3ffb791563aa014ef94142e4ac

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Adds policy Run key to start application

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

3
T1112

Tasks