General

  • Target

    INVPRF2100114_pdf.exe

  • Size

    412KB

  • Sample

    211007-efmvsabge7

  • MD5

    08be9eb13ce48889a767c1faf80fc855

  • SHA1

    4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9

  • SHA256

    7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737

  • SHA512

    5ccbdf445507b85c5b4595b430e26b5306d30abfe60047f5d2438a3294013a93cbf8d1136ab009b1cda87a5f662fb8ca5683a11ecb60a9636a0c2155c6d9d3b4

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Targets

    • Target

      INVPRF2100114_pdf.exe

    • Size

      412KB

    • MD5

      08be9eb13ce48889a767c1faf80fc855

    • SHA1

      4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9

    • SHA256

      7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737

    • SHA512

      5ccbdf445507b85c5b4595b430e26b5306d30abfe60047f5d2438a3294013a93cbf8d1136ab009b1cda87a5f662fb8ca5683a11ecb60a9636a0c2155c6d9d3b4

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks