General

  • Target

    PI_.exe

  • Size

    296KB

  • Sample

    211028-vs799aggaq

  • MD5

    3838c43e12f0c22ecf9a9a0c1deb1d30

  • SHA1

    7b9d8e4a093672411f71f1cf6a7fe6803c61773c

  • SHA256

    b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b

  • SHA512

    f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

unzn

C2

http://www.davanamays.com/unzn/

Decoy

xiulf.com

highcountrymortar.com

523561.com

marketingagency.tools

ganmovie.net

nationaalcontactpunt.com

sirrbter.com

begizas.xyz

missimi-fashion.com

munixc.info

daas.support

spaceworbc.com

faithtruthresolve.com

gymkub.com

thegrayverse.xyz

artisanmakefurniture.com

029tryy.com

ijuubx.biz

iphone13promax.club

techuniversus.com

Targets

    • Target

      PI_.exe

    • Size

      296KB

    • MD5

      3838c43e12f0c22ecf9a9a0c1deb1d30

    • SHA1

      7b9d8e4a093672411f71f1cf6a7fe6803c61773c

    • SHA256

      b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b

    • SHA512

      f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks