General

  • Target

    Payment Copy.exe

  • Size

    258KB

  • Sample

    210924-q74hdshbf9

  • MD5

    0d6e0449a278b6971826e0da856aed38

  • SHA1

    f95ea74f5d687eaedc24a2abadb77229e4918698

  • SHA256

    2dc7525f9ee6e09a25f840b457bf5b0ba228c4697e1f3d4b81bd2964d2eafc61

  • SHA512

    512a7984a5c9eccb6abad93a77a58497e32192a2197bb01e82ff7e17f0c5afcc796ecb4802c14d105e9ebec2479d22be39f0a4c2832e18ffabb991c211b6a9f7

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      Payment Copy.exe

    • Size

      258KB

    • MD5

      0d6e0449a278b6971826e0da856aed38

    • SHA1

      f95ea74f5d687eaedc24a2abadb77229e4918698

    • SHA256

      2dc7525f9ee6e09a25f840b457bf5b0ba228c4697e1f3d4b81bd2964d2eafc61

    • SHA512

      512a7984a5c9eccb6abad93a77a58497e32192a2197bb01e82ff7e17f0c5afcc796ecb4802c14d105e9ebec2479d22be39f0a4c2832e18ffabb991c211b6a9f7

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks