General

  • Target

    7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515

  • Size

    1.0MB

  • Sample

    211208-fegstafean

  • MD5

    290f5b81ba88a8699e9ebd35075f8a49

  • SHA1

    fad9a5952517ded62e0839b4cc99a9ba2e9b2ac4

  • SHA256

    7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515

  • SHA512

    6e5a3c544d043f8e68b3156ae6789eaae496ec60be810cb5eafc4cdbb2a63e711c2da4a268ff72ef271bd6bcd5c23b5ca7cdbbc96635ffe8bb63d0956bf72b09

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515

    • Size

      1.0MB

    • MD5

      290f5b81ba88a8699e9ebd35075f8a49

    • SHA1

      fad9a5952517ded62e0839b4cc99a9ba2e9b2ac4

    • SHA256

      7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515

    • SHA512

      6e5a3c544d043f8e68b3156ae6789eaae496ec60be810cb5eafc4cdbb2a63e711c2da4a268ff72ef271bd6bcd5c23b5ca7cdbbc96635ffe8bb63d0956bf72b09

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks