General

  • Target

    ORDER OCT 14,2021.exe

  • Size

    455KB

  • Sample

    211014-k82sasggg3

  • MD5

    ca68a998d9ed33841178fd898456fa70

  • SHA1

    5bf8490907f77aee7999ac5826a648ac2aaf4a64

  • SHA256

    a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d

  • SHA512

    a2e520583dc489897db757ff113df161e0110e48122f0a5730c742dbd415f454f35dfa458016853268a0e7e0f11cc13a2490249c7a130e53bec34aa999239d6c

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      ORDER OCT 14,2021.exe

    • Size

      455KB

    • MD5

      ca68a998d9ed33841178fd898456fa70

    • SHA1

      5bf8490907f77aee7999ac5826a648ac2aaf4a64

    • SHA256

      a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d

    • SHA512

      a2e520583dc489897db757ff113df161e0110e48122f0a5730c742dbd415f454f35dfa458016853268a0e7e0f11cc13a2490249c7a130e53bec34aa999239d6c

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks