General

  • Target

    tmp

  • Size

    925KB

  • Sample

    220508-m2jdgsgda9

  • MD5

    4470f83cba058890c43ded4a3940c3dc

  • SHA1

    f9c2953280646715ec9ad0d034a6eae43d1fc8c4

  • SHA256

    0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56

  • SHA512

    8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

arh2

Decoy

anniversaryalert.com

kinship.space

buabdullagroup.com

ghostprotectionagency.com

scion-go-getter.com

skindeepapp.com

kysp3.xyz

bonitaspringshomesearch.com

bestdeals2022.online

themarketingstinger.com

chengkayouxuan.com

fendoremi.com

j-stra.com

klingelecn.net

deluxecarepro.com

huanbaodg.com

mes-dents-blanches.com

solutionsemissionsimplifiee.com

abedbashir.tech

good-collection.store

Targets

    • Target

      tmp

    • Size

      925KB

    • MD5

      4470f83cba058890c43ded4a3940c3dc

    • SHA1

      f9c2953280646715ec9ad0d034a6eae43d1fc8c4

    • SHA256

      0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56

    • SHA512

      8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks