General

  • Target
    LETTER OF INTENT.exe
  • Size 750KB
  • Sample220218-spnekacfd6
  • SHA256 a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • uar3

Decoy
  • jogoreviravolta.com

  • keysine.com

  • sami60.com

  • morganators.com

  • referral.directory

  • campdiscount.info

  • vanwah.com

  • jmtmjz.com

  • der-transformationscode.com

  • evangelvalormedia.com

  • bedsidehomecare.com

  • novaair.net

  • privilegetroissecurity.com

  • elsiepupz.com

  • yy77kk.com

  • nt-renewable.com

  • alyaqoutalabyadhautoparts.com

  • start-play-now.com

  • myskew.com

  • himalaya-finance.com

Targets

    • Target
      LETTER OF INTENT.exe
    • Size 750KB
    • SHA256 a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks