General

  • Target
    Order sheet 31082021.exe
  • Size 728KB
  • Sample210831-j5ysf8stee
  • SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.3

Campaign
  • p4se

C2
  • http://www.appackersandmoversbengaluru.com/p4se/

Decoy
  • weightlossforprofessionals.com

  • talkotstopandshop.com

  • everesttechsolutions.com

  • garboarts.com

  • esubastas-online.com

  • electriclastmile.com

  • tomio.tech

  • jacoty.com

  • knot-tied-up.com

  • energychoicesim.com

  • rocketcompaniessham.com

  • madarasapattinam.com

  • promosplace.com

  • newstarchurch.com

  • thesaleskitchen.com

  • slingmodeinc.com

  • jobresulthub.com

  • pillclk.com

  • shipu119.com

  • sibalcar.com

Targets

    • Target
      Order sheet 31082021.exe
    • Size 728KB
    • SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks