General

  • Target

    RFQ_Beijing Chengruisi Manufacturing_pdf.exe

  • Size

    757KB

  • Sample

    210923-bac7lsebc4

  • MD5

    662ccb9b69a33a02460b368c77b17f04

  • SHA1

    9c61fbf1b27de772aebde4825a66b6da8bbf7517

  • SHA256

    662ae2a76488e0f775884f0c19daa286c910f2e72acb414a5f820b655ef42565

  • SHA512

    86f125976f1ef582afa3dbd289e2a369a14ae940401dd967bb9c5e262a53a1479bda3dad2a268f659eb901aabe3e4759c20c6968d0d1f2b9517b4577850b1fbb

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Targets

    • Target

      RFQ_Beijing Chengruisi Manufacturing_pdf.exe

    • Size

      757KB

    • MD5

      662ccb9b69a33a02460b368c77b17f04

    • SHA1

      9c61fbf1b27de772aebde4825a66b6da8bbf7517

    • SHA256

      662ae2a76488e0f775884f0c19daa286c910f2e72acb414a5f820b655ef42565

    • SHA512

      86f125976f1ef582afa3dbd289e2a369a14ae940401dd967bb9c5e262a53a1479bda3dad2a268f659eb901aabe3e4759c20c6968d0d1f2b9517b4577850b1fbb

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks