Overview

overview

10

Static

static

8

SUPPLY_ORD...DF.exe

windows7_x64

3

SUPPLY_ORD...DF.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SUPPLY_ORDER_QUOTE_88979_PDF.exe
  • Size 428KB
  • Sample210830-8d1en84epa
  • SHA256 f8efe3e66289ce15fd9b0f85a3e0d90660cae9f12385f69e81cfb6f2e3ece3c7
  • MD5 SHA1 SHA512
Score
10/10
xloadera6hgloaderratupx

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

Campaign

  • a6hg

C2

  • http://www.cammininelmondo.com/a6hg/

Decoy

  • gatewless.net

  • novomercante.com

  • ibnkhaldun.academy

  • yohilo.tech

  • pickahousetoday.com

  • progressiveneighborsmd.com

  • liammcneeley.com

  • gzmxican.com

  • rotationdiet.net

  • j3esh4hfwret3.net

  • learnshort.com

  • yuukanclub.info

  • ryrex.com

  • andreasvalor.com

  • nflclocks.com

  • petsjoyfulsmile.com

  • jattfatehpur.com

  • brittneyllong.com

  • lk-ty.com

  • swipehawk.com

Targets

    • Target
      SUPPLY_ORDER_QUOTE_88979_PDF.exe
    • Size 428KB
    • SHA256 f8efe3e66289ce15fd9b0f85a3e0d90660cae9f12385f69e81cfb6f2e3ece3c7
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadera6hgloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks