General

  • Target

    346c1f083ba87535c999f17587d0d8b9

  • Size

    252KB

  • Sample

    231225-w3f47aebc7

  • MD5

    346c1f083ba87535c999f17587d0d8b9

  • SHA1

    82a6caee2df88f4944f0f144e70f8d70675ec45e

  • SHA256

    537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec

  • SHA512

    086617b903ad3ae3c4145a9b3f122e560c64f4f0ef7a153b980f35213fa58ff5d9d480956502183ba1f310dbe0337efb81997d0f2b16a1bf751ad78935a8577b

  • SSDEEP

    6144:sd53TvpHeIl0m7YIK9fdiqEOfdaEujuUNrYnKX2xB3ijwOlSMJIZ+:sd53TvpHeIl0mkIE15yNrYnKXwpShJI4

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

dy8g

Decoy

mzyxi-rkah-y.net

okinawarongnho.com

qq66520.com

nimbus.watch

cwdelrio.com

regalshopper.com

avito-payment.life

jorgeporcayo.com

galvinsky.digital

guys-only.com

asmfruits-almacenes.com

boatrace-life04.net

cochez.club

thelastvictor.net

janieleconte.com

ivoirepneus.com

saludflv.info

mydreamtv.net

austinphy.com

cajunseafoodstcloud.com

Targets

    • Target

      346c1f083ba87535c999f17587d0d8b9

    • Size

      252KB

    • MD5

      346c1f083ba87535c999f17587d0d8b9

    • SHA1

      82a6caee2df88f4944f0f144e70f8d70675ec45e

    • SHA256

      537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec

    • SHA512

      086617b903ad3ae3c4145a9b3f122e560c64f4f0ef7a153b980f35213fa58ff5d9d480956502183ba1f310dbe0337efb81997d0f2b16a1bf751ad78935a8577b

    • SSDEEP

      6144:sd53TvpHeIl0m7YIK9fdiqEOfdaEujuUNrYnKX2xB3ijwOlSMJIZ+:sd53TvpHeIl0mkIE15yNrYnKXwpShJI4

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks