General

  • Target
    Sauermann New Order.exe
  • Size 524KB
  • Sample211012-nckexsccc4
  • SHA256 5d5aa4f1afaa9dd98bc1317f5b8e190cf21130d465da575fac9d4fbc6b3fb3af
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • b5ce

C2
  • http://www.rheilea.com/b5ce/

Decoy
  • advellerd.xyz

  • giasuvina.com

  • arab-xt-pro.com

  • ahsltu2ua4.com

  • trasportesemmanuel.com

  • kissimmeesoccercup.com

  • studyengland.com

  • m2volleyballclub.com

  • shyuehuan.com

  • elsml.com

  • blog-x-history.top

  • coditeu.com

  • allattachments.net

  • vigautruc.com

  • mentication.com

  • zambiaedu.xyz

  • filadelfiacenter.com

  • avlaborsourceinc.info

  • tameka-stewart.com

  • studio-cleo.com

Targets

    • Target
      Sauermann New Order.exe
    • Size 524KB
    • SHA256 5d5aa4f1afaa9dd98bc1317f5b8e190cf21130d465da575fac9d4fbc6b3fb3af
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks