General

  • Target
    SOA-1236-1132220.exe
  • Size 511KB
  • Sample220113-njajashfg9
  • SHA256 459c86bf11535b9d62c895a6677a5eb40d8f0cf3136477e5da746045bf3fb6a3
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • eb4c

Decoy
  • rasmkv.com

  • klhb1000.com

  • usales.agency

  • x4g7ae8.com

  • englishtutors.store

  • coffeegirlstuff.com

  • vpb-haiphong.com

  • noonesown.com

  • totallyglamplans.com

  • hlthtec.com

  • sculpturehairandfashion.com

  • jewelsjoule.com

  • ref-30001-p.com

  • brairazur.xyz

  • lilithsag.com

  • degengains.com

  • 5d-crypto.com

  • sanfeca.com

  • wonderfulsunny.com

  • syntheticloot.net

Targets

    • Target
      SOA-1236-1132220.exe
    • Size 511KB
    • SHA256 459c86bf11535b9d62c895a6677a5eb40d8f0cf3136477e5da746045bf3fb6a3
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks