Resubmissions

28-02-2022 11:21

220228-nf6sbseag4 10

28-02-2022 10:20

220228-mc49naeaa3 10

General

  • Target

    5d6dba1a42b0579aea51e3875bd171c4

  • Size

    1.0MB

  • Sample

    220228-mc49naeaa3

  • MD5

    5d6dba1a42b0579aea51e3875bd171c4

  • SHA1

    bacbe628d565ede6c15550469e912a1c6bba16ee

  • SHA256

    60b97b4d45e3850d57a661bf37987909c1f99096384123594cc1b79d5449348f

  • SHA512

    20ba7979b210768c4cb83f1849e240b28389a946d2ac12986bffb1a8309ddbcb33ac0235b30a821fdccbe0c11aa19de61037f92dcb8b1d0e1d5a0243ed540b0f

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mc3w

Decoy

pegasusworlddigital.com

lumbungpanganreborn.com

familyresourcesystems.com

smallbusniessbenefits.com

strategia-firm.xyz

rokkos.club

geo1.tirol

dreamnft.xyz

yourprofits6.com

plshi.top

atmosferas.net

appcast-76.com

lilufigu.digital

jobby.guide

bregnic.art

stooshbotanicals.com

tiktok-lifts.com

dozercafe.com

parmarthmissionhospital.com

yufude.com

Targets

    • Target

      5d6dba1a42b0579aea51e3875bd171c4

    • Size

      1.0MB

    • MD5

      5d6dba1a42b0579aea51e3875bd171c4

    • SHA1

      bacbe628d565ede6c15550469e912a1c6bba16ee

    • SHA256

      60b97b4d45e3850d57a661bf37987909c1f99096384123594cc1b79d5449348f

    • SHA512

      20ba7979b210768c4cb83f1849e240b28389a946d2ac12986bffb1a8309ddbcb33ac0235b30a821fdccbe0c11aa19de61037f92dcb8b1d0e1d5a0243ed540b0f

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks