General

  • Target
    IMG 29987 SHIPMENT Order 85 3.02.2022.exe
  • Size 558KB
  • Sample220203-rf5rtaabd9
  • SHA256 af662c52d97d2590fa9a275d02feaf5aab3c18365e002a288efd862bd09aa6b4
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • p8ce

Decoy
  • wishmeluck1.xyz

  • nawabumi.com

  • terra.fish

  • eoraipsumami.quest

  • awakeningyourid.com

  • csyein.com

  • tslsinteligentes.com

  • cataractusa.com

  • capitalwheelstogo.com

  • staffremotely.com

  • trashbinwasher.com

  • blaneyparkrendezvous.com

  • yolrt.com

  • northendtaproom.com

  • showgeini.com

  • b95206.com

  • almcpersonaltraining.com

  • lovabledoodleshome.com

  • woodlandstationcondos.com

  • nikahlive.com

Targets

    • Target
      IMG 29987 SHIPMENT Order 85 3.02.2022.exe
    • Size 558KB
    • SHA256 af662c52d97d2590fa9a275d02feaf5aab3c18365e002a288efd862bd09aa6b4
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks