General

  • Target

    DOC.exe

  • Size

    463KB

  • Sample

    210916-ff96racab2

  • MD5

    e2e027360aa11a532949fb6c013009d5

  • SHA1

    2488a833ee33ea4ce3ff0e5e7615e35d647816e2

  • SHA256

    13c2ff62d1e29d6e88c828851f842b17acb6293da92bdf5223e87a67bf00ed31

  • SHA512

    240a63a3c245d1dd963cc33b290796e646276f9488692037f26009efde4ad39b9c6af6d0c4d21ca19b5ade4a677b4b2d7e83003a519c2dbfbf408c086ca0f04a

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

n58i

C2

http://www.nordicbatterybelt.net/n58i/

Decoy

southerncircumstance.com

mcsasco.com

ifbrick.com

societe-anonyme.net

bantank.xyz

dogecoin.beauty

aboutacoffee.com

babalandlordrealestate.com

tintgta.com

integrity.directory

parwnr.icu

poltishof.online

stayandstyle.com

ickjeame.xyz

currentmotors.ca

pond.fund

petrosterzis.com

deadbydaylightpoints.com

hotel-balzac.paris

focusmaintainance.com

Targets

    • Target

      DOC.exe

    • Size

      463KB

    • MD5

      e2e027360aa11a532949fb6c013009d5

    • SHA1

      2488a833ee33ea4ce3ff0e5e7615e35d647816e2

    • SHA256

      13c2ff62d1e29d6e88c828851f842b17acb6293da92bdf5223e87a67bf00ed31

    • SHA512

      240a63a3c245d1dd963cc33b290796e646276f9488692037f26009efde4ad39b9c6af6d0c4d21ca19b5ade4a677b4b2d7e83003a519c2dbfbf408c086ca0f04a

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

1
T1082

Tasks