General

  • Target

    7a0cd1587a69eaf31f745c4f39b0bfbbfbf23f1d1b483b1448da6b90fdaf6caa

  • Size

    575KB

  • Sample

    211125-1ekvpacba4

  • MD5

    b7d948e18b116624ee4a0e2e4c6e21e9

  • SHA1

    d0ccf7375cdf29e0071dce6fe8405d0007f51e94

  • SHA256

    7a0cd1587a69eaf31f745c4f39b0bfbbfbf23f1d1b483b1448da6b90fdaf6caa

  • SHA512

    553a9a44a6123705d91eae9d593d2a494b85dc527ab4aec7c964dc657486091143b2ddc15e5c209e27d88deaa5683096131018cc4d6d715085caf2fb6080cc70

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Targets

    • Target

      7a0cd1587a69eaf31f745c4f39b0bfbbfbf23f1d1b483b1448da6b90fdaf6caa

    • Size

      575KB

    • MD5

      b7d948e18b116624ee4a0e2e4c6e21e9

    • SHA1

      d0ccf7375cdf29e0071dce6fe8405d0007f51e94

    • SHA256

      7a0cd1587a69eaf31f745c4f39b0bfbbfbf23f1d1b483b1448da6b90fdaf6caa

    • SHA512

      553a9a44a6123705d91eae9d593d2a494b85dc527ab4aec7c964dc657486091143b2ddc15e5c209e27d88deaa5683096131018cc4d6d715085caf2fb6080cc70

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks