General

  • Target

    9ec07103c052555c630c02674ceff8d8

  • Size

    654KB

  • Sample

    211203-myek5agbcm

  • MD5

    9ec07103c052555c630c02674ceff8d8

  • SHA1

    ebde834f4e440a9f560a5ef41831832e5396f82d

  • SHA256

    99ce2e68255b2f3b1ee1934af1eacd280a096adaedcaa2df1f03e8d9ee01e860

  • SHA512

    c21b211407903c8bbb3e492adaf155c1751b180efc1de7dcc6cd65194f0ba32c5271c7e0a49b5634d8a376831149f912d7bc18d5965465a6a68c42e3e1ba86e8

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Targets

    • Target

      9ec07103c052555c630c02674ceff8d8

    • Size

      654KB

    • MD5

      9ec07103c052555c630c02674ceff8d8

    • SHA1

      ebde834f4e440a9f560a5ef41831832e5396f82d

    • SHA256

      99ce2e68255b2f3b1ee1934af1eacd280a096adaedcaa2df1f03e8d9ee01e860

    • SHA512

      c21b211407903c8bbb3e492adaf155c1751b180efc1de7dcc6cd65194f0ba32c5271c7e0a49b5634d8a376831149f912d7bc18d5965465a6a68c42e3e1ba86e8

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks