General

  • Target
    Inquiry Order 26-09-2021.exe
  • Size 818KB
  • Sample210927-kc16wsgbd6
  • SHA256 c4c9d27ea805c32e7f0e66dc0d9534d8fbd87f4c1327727b2e1e9ae937f02c45
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • b5ce

C2
  • http://www.rheilea.com/b5ce/

Decoy
  • advellerd.xyz

  • giasuvina.com

  • arab-xt-pro.com

  • ahsltu2ua4.com

  • trasportesemmanuel.com

  • kissimmeesoccercup.com

  • studyengland.com

  • m2volleyballclub.com

  • shyuehuan.com

  • elsml.com

  • blog-x-history.top

  • coditeu.com

  • allattachments.net

  • vigautruc.com

  • mentication.com

  • zambiaedu.xyz

  • filadelfiacenter.com

  • avlaborsourceinc.info

  • tameka-stewart.com

  • studio-cleo.com

Targets

    • Target
      Inquiry Order 26-09-2021.exe
    • Size 818KB
    • SHA256 c4c9d27ea805c32e7f0e66dc0d9534d8fbd87f4c1327727b2e1e9ae937f02c45
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks