General

  • Target

    Request For Quotation.exe

  • Size

    349KB

  • Sample

    211026-mm9bcshbg3

  • MD5

    6ff3af29fcf1cabca1e7df8a6094e4a3

  • SHA1

    f382d117151ad79fa9ecd42920fe63e105aed461

  • SHA256

    f8b6860b5f79411ce377df615b3e72745e773c9e89347fdf00adea4f8200e51d

  • SHA512

    578cc3c53fcbc51b42b18e0cedf898b9540e74a13a075d312e776b42c5c46f5d14db0e81d76f87efc90c3fe0b34a421388c48d573846ae37de88003d6cea3661

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      Request For Quotation.exe

    • Size

      349KB

    • MD5

      6ff3af29fcf1cabca1e7df8a6094e4a3

    • SHA1

      f382d117151ad79fa9ecd42920fe63e105aed461

    • SHA256

      f8b6860b5f79411ce377df615b3e72745e773c9e89347fdf00adea4f8200e51d

    • SHA512

      578cc3c53fcbc51b42b18e0cedf898b9540e74a13a075d312e776b42c5c46f5d14db0e81d76f87efc90c3fe0b34a421388c48d573846ae37de88003d6cea3661

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks