General

  • Target
    53544ac714cdbf8c07338ce6ec478057.exe
  • Size 249KB
  • Sample220125-nb1qhsfaf6
  • SHA256 75362f20dab8d57db3ade6427e647b0bc01d8345ccfa9781d5778877f04f7fb5
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • o6tg

Decoy
  • turkscaicosonline.com

  • novelfoodtech.com

  • zgrmfww.com

  • gestionalcliente24hrs.store

  • postrojka.com

  • tapissier-uzes.com

  • tobytram.one

  • preamblegames.com

  • clicklinkzs.com

  • franksenen.com

  • beautygateway.net

  • foils-online.com

  • aout.us

  • promarkoperations.com

  • alignatura.com

  • changemylifefast.info

  • minbex.icu

  • internethustlersociety.com

  • chinacqn.com

  • fibsh.com

Targets

    • Target
      53544ac714cdbf8c07338ce6ec478057.exe
    • Size 249KB
    • SHA256 75362f20dab8d57db3ade6427e647b0bc01d8345ccfa9781d5778877f04f7fb5
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks