General

  • Target

    87970c3d479f52f00f2b9de1ea942717

  • Size

    464KB

  • Sample

    211021-lh7fjaaah7

  • MD5

    87970c3d479f52f00f2b9de1ea942717

  • SHA1

    751d93f7f3025d9c5487cd3382b082d89f38da8c

  • SHA256

    62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6

  • SHA512

    9e0434b917713b39621aff4253ec07fae3b2f7399c9293acd2243e09c091f1713df532e5bfb66fc25926cd0bec2456ec62b57ed0f685ad00e94e1d4d2c279c57

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      87970c3d479f52f00f2b9de1ea942717

    • Size

      464KB

    • MD5

      87970c3d479f52f00f2b9de1ea942717

    • SHA1

      751d93f7f3025d9c5487cd3382b082d89f38da8c

    • SHA256

      62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6

    • SHA512

      9e0434b917713b39621aff4253ec07fae3b2f7399c9293acd2243e09c091f1713df532e5bfb66fc25926cd0bec2456ec62b57ed0f685ad00e94e1d4d2c279c57

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks