General

  • Target

    32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e

  • Size

    993KB

  • Sample

    211210-l9a7eagba9

  • MD5

    2e81ceb459073a4988b86572485ce064

  • SHA1

    537788a13b833bbe3993e6ddd3f4c1abf12caf94

  • SHA256

    32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e

  • SHA512

    fa7e4ba4c10db2914051df3dc62108fdf545e1ac26e32498b0fc539bd874146b355c6e59892b870b254fad1f2b4468d99e4872da5f661916ecabfd76bda58b4a

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Targets

    • Target

      32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e

    • Size

      993KB

    • MD5

      2e81ceb459073a4988b86572485ce064

    • SHA1

      537788a13b833bbe3993e6ddd3f4c1abf12caf94

    • SHA256

      32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e

    • SHA512

      fa7e4ba4c10db2914051df3dc62108fdf545e1ac26e32498b0fc539bd874146b355c6e59892b870b254fad1f2b4468d99e4872da5f661916ecabfd76bda58b4a

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks