General

  • Target

    export.bin

  • Size

    163KB

  • Sample

    211028-sg5c4sgefj

  • MD5

    530dce2f8c7d77d8c24946833b91213f

  • SHA1

    06bae2812c4013e9ba76667265b4e1350652a911

  • SHA256

    661bc869d44945a8cfc681e6f8f2c9fe1c352ab983bf8d8ad0676cc57493ac47

  • SHA512

    e8a12bdb443466f94b374dd865178954825a5284db2e82e55826865050a8da2c8a7c2a88564052c128a47c53ef9b0aaa231a361912cbea9c4af739413add6f4a

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b0us

C2

http://www.bbyyn10.xyz/b0us/

Decoy

wxoi.xyz

boss-note-to-look-today.info

rxgmarket.com

vyfstudio.com

insularrofioa.xyz

psikologtenaysude.com

hepatitiscsignssymptoms.space

toadvalleyfarm.com

rhinobeds.com

joystoreworld.com

wethinky.com

cucciolamores.com

finansresultation.com

criptodigital.online

cave21shop.com

ryannaat.xyz

xn--ngbr0em.com

olympiaapartment.com

asrendo.com

dashmints.com

Targets

    • Target

      export.bin

    • Size

      163KB

    • MD5

      530dce2f8c7d77d8c24946833b91213f

    • SHA1

      06bae2812c4013e9ba76667265b4e1350652a911

    • SHA256

      661bc869d44945a8cfc681e6f8f2c9fe1c352ab983bf8d8ad0676cc57493ac47

    • SHA512

      e8a12bdb443466f94b374dd865178954825a5284db2e82e55826865050a8da2c8a7c2a88564052c128a47c53ef9b0aaa231a361912cbea9c4af739413add6f4a

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks