General

  • Target

    PAYMENT COPY.zip

  • Size

    444KB

  • Sample

    210923-h6lbesadgr

  • MD5

    9215c74633aad1e50c2773821115d29e

  • SHA1

    75847263fef1cb127e2054cb789f4f28f317f86c

  • SHA256

    fd6d7a2c46ceee6b66631de158019d4de85c3c63528ed8085552d414ff413ccd

  • SHA512

    e161a658203ede7e23a0fed631719e9a26092e225d24fad7c825c4a5e2ec1ea4b6dc85a02230da3f64fc52a76b259feea9e7a675e34cd02c0a87ad39ea99b823

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Targets

    • Target

      PAYMENT COPY.exe

    • Size

      1005KB

    • MD5

      9204ace7a5758570dbd35a19530591c5

    • SHA1

      69e92bf2483d4224bc3d0d2f6abb0d37810774df

    • SHA256

      ed4ba3559a925d94bd2917dd5d4247d84e904b1e8423c21e40a0b9efc7b295d6

    • SHA512

      7a78026223945e38d8c3364486585cd64658b4f4063b4ba3ba9a6d26ce435f598d9d829448a2de4ebfe6ffb5908a47bdc37378836a21bd69de31ef89d869c500

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks