General

  • Target
    f9d0f03aba5378393fe83fa8e473b89a.exe
  • Size 493KB
  • Sample210929-hzdyrsdhf2
  • SHA256 64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • m0np

C2
  • http://www.devmedicalcentre.com/m0np/

Decoy
  • gruppovimar.com

  • seniordatingtv.com

  • pinpinyouqian.website

  • retreatreflectreplenish.com

  • baby-handmade.store

  • econsupplies.com

  • helloaustinpodcast.com

  • europe-lodging.com

  • ferahanaokulu.com

  • thehomeinspo.com

  • rawhoneytnpasumo6.xyz

  • tyckasei.quest

  • scissorsandbuffer.com

  • jatinvestmentsmaldives.com

  • softandcute.store

  • afuturemakerspromotions.online

  • leonsigntech.com

  • havetheshortscovered.com

  • cvkf.email

  • iplyyu.com

Targets

    • Target
      f9d0f03aba5378393fe83fa8e473b89a.exe
    • Size 493KB
    • SHA256 64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks