General

  • Target

    REQUEST FOR QUOTATION.exe

  • Size

    254KB

  • Sample

    211021-qyjrmaadc2

  • MD5

    cc19c69f756ab25010c68a64b03f2eee

  • SHA1

    48e28f2fcb7a13efa879b99b14ba52571b6e5224

  • SHA256

    ac4a0328d512526f20122f0399d557b1334f3b2ac264d9e749d6d2788e956b2e

  • SHA512

    6a0caa9934e2c4366e312be5b6ce60e0d3ffb715ee6d97eaf13dc4cd485d305e2972868624e4460b5076ff0eec1a94ba20199f2502ab290a584b0705ff12d762

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

epz2

C2

http://www.pofungrealty.com/epz2/

Decoy

moslemco.com

besrbee.com

in-teh.com

fofomej.xyz

partner2form.com

codigocentro.com

thgn29.xyz

behindwp.com

oliviatevents.com

jammineugene.com

colobohieran.quest

freidenfelt.com

ribbitathleticwear.com

dreamlylife.com

hotelcxn.com

preciosaglass.com

lawaves.net

thatsnotmydriveway.com

northportbusinesscenter.com

dayinamman.com

Targets

    • Target

      REQUEST FOR QUOTATION.exe

    • Size

      254KB

    • MD5

      cc19c69f756ab25010c68a64b03f2eee

    • SHA1

      48e28f2fcb7a13efa879b99b14ba52571b6e5224

    • SHA256

      ac4a0328d512526f20122f0399d557b1334f3b2ac264d9e749d6d2788e956b2e

    • SHA512

      6a0caa9934e2c4366e312be5b6ce60e0d3ffb715ee6d97eaf13dc4cd485d305e2972868624e4460b5076ff0eec1a94ba20199f2502ab290a584b0705ff12d762

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

2
T1082

Tasks