General

  • Target

    Quotation- urgent basis.exe

  • Size

    349KB

  • Sample

    211015-z57lpsccgq

  • MD5

    ef946df7574b283bf24b349d2cb679bf

  • SHA1

    5100dfe4456adfd5cea41b5c137ea9e2fd10c7f7

  • SHA256

    5bb8975c8a7e8080a8a68034458adfb7b8e9812b5a1fdd15f891656b03d086e6

  • SHA512

    1a06445a1433fa1701ce6a06b9c3d134f2322dde48994a4ed1d1805fb2b8d49b859d2ffefcfa7f967af49b4f761e2629530e3a37389d271516719b8b43e94108

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      Quotation- urgent basis.exe

    • Size

      349KB

    • MD5

      ef946df7574b283bf24b349d2cb679bf

    • SHA1

      5100dfe4456adfd5cea41b5c137ea9e2fd10c7f7

    • SHA256

      5bb8975c8a7e8080a8a68034458adfb7b8e9812b5a1fdd15f891656b03d086e6

    • SHA512

      1a06445a1433fa1701ce6a06b9c3d134f2322dde48994a4ed1d1805fb2b8d49b859d2ffefcfa7f967af49b4f761e2629530e3a37389d271516719b8b43e94108

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks