General

  • Target

    20f72f39ebdafb29f1385adbf2df6304

  • Size

    471KB

  • Sample

    231225-qg418sggdm

  • MD5

    20f72f39ebdafb29f1385adbf2df6304

  • SHA1

    51f68cbe27c9139f8a994b396d3ce06354f7bb6a

  • SHA256

    cfa69b2fc294f2b6ea165dfaa5af58995aad4e08c91d075fc465fd7b756cf364

  • SHA512

    bed2aa932aade8693a9cd14e6ec38b2ef8e02f19b8dd1ab38487199a74b6f88fe82f803bc05a3dfdec16d34a890f4c0c6041b63677c6faf89eadd30a55e78c45

  • SSDEEP

    6144:FxlKPVR55Qnii8rmCikLdX0bRCt45AHUzRNE1N21zPBc1qLJZQ0G:zI35iii8H0bRC9UzK6z5RJZQ0G

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

rqe8

Decoy

bjft.net

abrosnm3.com

badlistens.com

signal-japan.com

schaka.com

kingdompersonalbranding.com

sewmenship.com

lzproperty.com

mojoimpacthosting.com

carinsurancecoverage.care

corporatemercadona.com

mobileswash.com

forevercelebration2026.com

co-het.com

bellesherlou.com

commentsoldgolf.com

onlytwod.group

utesco.info

martstrip.com

onszdgu.icu

Targets

    • Target

      20f72f39ebdafb29f1385adbf2df6304

    • Size

      471KB

    • MD5

      20f72f39ebdafb29f1385adbf2df6304

    • SHA1

      51f68cbe27c9139f8a994b396d3ce06354f7bb6a

    • SHA256

      cfa69b2fc294f2b6ea165dfaa5af58995aad4e08c91d075fc465fd7b756cf364

    • SHA512

      bed2aa932aade8693a9cd14e6ec38b2ef8e02f19b8dd1ab38487199a74b6f88fe82f803bc05a3dfdec16d34a890f4c0c6041b63677c6faf89eadd30a55e78c45

    • SSDEEP

      6144:FxlKPVR55Qnii8rmCikLdX0bRCt45AHUzRNE1N21zPBc1qLJZQ0G:zI35iii8H0bRC9UzK6z5RJZQ0G

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks