Docs No-65224XXX [ORDER-2021].exe

General
Target

Docs No-65224XXX [ORDER-2021].exe

Size

973KB

Sample

211021-qvadsabcaq

Score
10 /10
MD5

994a2d143c5619a11906c87244855858

SHA1

dc6c06fb2c1acf3164db514878209ec6aec95cac

SHA256

19b95be1b0c890804845c8c6e19cef972c89bfc8156201c3490f047ebfc42ed4

SHA512

271531df66b27cdc1e4f53774c820c186218d6c17a19387a47530a7b1910960e0d517150f88082ea3b03c9abb85f2ccfa9c8ca2d5e7864844179145b32e9b607

Malware Config

Extracted

Family xloader
Version 2.5
Campaign epns
C2

http://www.lnvietnam.online/epns/

Decoy

mmfaccao.com

blttsperma.quest

946abe.net

indispensablehands.com

jkformationfrance.com

phonerepaire.com

lienquan-trian.com

youkuti.com

empowermindbodystudios.com

seunicapf.com

fk-link.xyz

kunai.tech

difficultbutdoablebrand.com

ejworkspace.com

teracorp.biz

thekids.today

quintaalentejana.com

annaviruksham.com

jshengrong.com

nsmetalmakina.xyz

hentainftd.com

alphabet-chicken-farms.com

erotikchat.red

skintipsllc.com

expressofertachegou.com

ygraeriotexniki.com

thesidehustler.net

visionries.com

deployinghigh.com

havana-smile.com

exclusivegift7.com

ephraimhomedeals.com

westquartier.com

kiingear.com

officecom-myaccount.com

lemomentconcept.com

royalteacherclass.com

alltart.com

hustlershandbook.biz

mxpvlv.biz

canalcorporate.com

carcity.toys

k6tkuwrnjake.biz

acrobike69.com

4000518883.com

katia-magnetisme.com

shiningproent.com

ikmbc-b02.com

thoughtsbig.com

baba.clinic

Targets
Target

Docs No-65224XXX [ORDER-2021].exe

MD5

994a2d143c5619a11906c87244855858

Filesize

973KB

Score
10 /10
SHA1

dc6c06fb2c1acf3164db514878209ec6aec95cac

SHA256

19b95be1b0c890804845c8c6e19cef972c89bfc8156201c3490f047ebfc42ed4

SHA512

271531df66b27cdc1e4f53774c820c186218d6c17a19387a47530a7b1910960e0d517150f88082ea3b03c9abb85f2ccfa9c8ca2d5e7864844179145b32e9b607

Tags

Signatures

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

    Tags

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Description

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • Xloader Payload

    Tags

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks