General

  • Target

    334825f45ad9208f0981087ef2ba7dfb

  • Size

    924KB

  • Sample

    231225-wqltxacaf4

  • MD5

    334825f45ad9208f0981087ef2ba7dfb

  • SHA1

    26ed950afa4f29da8a48a0602fd48d9ac36673ef

  • SHA256

    bc7716f2b0a56efa5e69ec4f10454240533b53cd3f5190b18d57f080019e5f2a

  • SHA512

    f973bdaccc568657186a698108bce019800c6b2545940d773cebc2d4c634ede35769ae2b353bb728c418133c1ceb78b1e74d331d8827d62fb948fbe0a5d8c9e6

  • SSDEEP

    12288:bwfPJ0e0b97iOUWp7NR4AnYVxCKQp2IXLzEmNx1LIfOCr+NyaUVKnpS5vegDDNKQ:sqeKHrJvY7UBnNrINr+wahpM

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

f4ut

Decoy

studiokventura.com

rmnslashes.com

oklahomapropertybuyersllc.com

pmfce.net

yingkuncy.com

theailearning.com

artistic1cleaning.com

shqinyue.com

dentaldunya.com

karatuhotel.com

renttoownhomephoenix.com

0087wt.com

hotelsearchkwnet.com

dentavangart.com

98700l.com

seattleproducecompany.com

magicparadigm.com

cunix88.com

vr646.com

calmonleiloes.com

Targets

    • Target

      334825f45ad9208f0981087ef2ba7dfb

    • Size

      924KB

    • MD5

      334825f45ad9208f0981087ef2ba7dfb

    • SHA1

      26ed950afa4f29da8a48a0602fd48d9ac36673ef

    • SHA256

      bc7716f2b0a56efa5e69ec4f10454240533b53cd3f5190b18d57f080019e5f2a

    • SHA512

      f973bdaccc568657186a698108bce019800c6b2545940d773cebc2d4c634ede35769ae2b353bb728c418133c1ceb78b1e74d331d8827d62fb948fbe0a5d8c9e6

    • SSDEEP

      12288:bwfPJ0e0b97iOUWp7NR4AnYVxCKQp2IXLzEmNx1LIfOCr+NyaUVKnpS5vegDDNKQ:sqeKHrJvY7UBnNrINr+wahpM

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks