General
Target

Rfq#001.zip

Size

241KB

Sample

211029-w1t82adha2

Score
10/10
MD5

26478ed2d6bfad2ba3d4d65ec47fb0f6

SHA1

be4fe3fc18b29dcab934000d7a90cf8a735eec53

SHA256

c59e9af65070704057d9d0388d84f6c0be3ee7aa61390d8822e927239172ffbf

SHA512

8d2746a8b497936bb534b627bba2bc69d56fd2c1eb3f9fea941c3a0ba90c9a04498c24d84e0c4f761b14f10aa264a006b9b4c2be8fc6cd1c4be9a4ec2b712b5e

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

unzn

C2

http://www.davanamays.com/unzn/

Decoy

xiulf.com

highcountrymortar.com

523561.com

marketingagency.tools

ganmovie.net

nationaalcontactpunt.com

sirrbter.com

begizas.xyz

missimi-fashion.com

munixc.info

daas.support

spaceworbc.com

faithtruthresolve.com

gymkub.com

thegrayverse.xyz

artisanmakefurniture.com

029tryy.com

ijuubx.biz

iphone13promax.club

techuniversus.com

samrgov.xyz

grownupcurl.com

sj0755.net

beekeeperkit.com

richessesabondantes.com

xclgjgjh.net

webworkscork.com

vedepviet365.com

bretabeameven.com

cdzsmhw.com

clearperspective.biz

tigrg5g784sh.biz

bbezan011.xyz

mycar.store

mansooralobeidli.com

ascensionmemberszoom.com

unlimitedrehab.com

wozka.top

askylarkgoods.com

rj793.com

prosvalor.com

primetimeexpress.com

boixosnoisperu.com

mmasportgear.com

concertiranian.net

hyponymys.info

maila.one

yti0fyic.xyz

shashiprayag.com

speedprosmotorsports.com

Targets
Target

Rfq#001.exe

MD5

8f558dc1338758e9fda83eab8ba9e7a9

Filesize

266KB

Score
10/10
SHA1

abbc4650a4ba5a91ffa99bbd0c1238d0e6e166a7

SHA256

cd89124cf3f0de7157d5f500b1dd20603a19ed890773d9cb9b1d1ea5b5372005

SHA512

d67fc009cc4d95f604540927601e9558432940b2bcefc126967f2dca4aefaa52761758c464cbe7ae42b6fb75305d721a814dbfedf48867df54d6cd733f9803df

Tags

Signatures

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

    Tags

  • Xloader Payload

    Tags

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      Score
                      1/10

                      behavioral1

                      Score
                      10/10

                      behavioral2

                      Score
                      10/10