General

  • Target

    15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

  • Size

    905KB

  • Sample

    220107-fp4qbscccl

  • MD5

    548d5acd91befcf89ccc80c9d8256002

  • SHA1

    776f4950f8109003c1d88e53d7921d27280a3ae7

  • SHA256

    15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

  • SHA512

    66d54b8c882ffd9c47e941fcaa35e95c0b1f31281b7490b444b7bc65ead3377d2d4d7f82b53201dedd03771ac38f498760898005b9a5287b4e9997a152ab01a6

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Targets

    • Target

      15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

    • Size

      905KB

    • MD5

      548d5acd91befcf89ccc80c9d8256002

    • SHA1

      776f4950f8109003c1d88e53d7921d27280a3ae7

    • SHA256

      15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

    • SHA512

      66d54b8c882ffd9c47e941fcaa35e95c0b1f31281b7490b444b7bc65ead3377d2d4d7f82b53201dedd03771ac38f498760898005b9a5287b4e9997a152ab01a6

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks