General

  • Target

    1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6

  • Size

    703KB

  • Sample

    211101-lyytbsedbj

  • MD5

    3ea0aeb40da1e753c6b9ce2981d25e51

  • SHA1

    3e28a132b435a95adfe9339f93556a78a4d0f41f

  • SHA256

    1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6

  • SHA512

    cd45ff5a4aab4ff7c1d40c0554401c9170a61407df0e23f11f85a28b5733cd504a2c947e858639656b45edd968e544d2358ac350673b0fe384ef8ad641e8a592

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Targets

    • Target

      1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6

    • Size

      703KB

    • MD5

      3ea0aeb40da1e753c6b9ce2981d25e51

    • SHA1

      3e28a132b435a95adfe9339f93556a78a4d0f41f

    • SHA256

      1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6

    • SHA512

      cd45ff5a4aab4ff7c1d40c0554401c9170a61407df0e23f11f85a28b5733cd504a2c947e858639656b45edd968e544d2358ac350673b0fe384ef8ad641e8a592

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks