General

  • Target

    73f4257033c590c868506ed0a0aa7a29

  • Size

    1.6MB

  • Sample

    231226-rayrbadgd3

  • MD5

    73f4257033c590c868506ed0a0aa7a29

  • SHA1

    bf288989eec6aa6a6f4bb2696d189d08d268e0db

  • SHA256

    cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b

  • SHA512

    27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392

  • SSDEEP

    24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Targets

    • Target

      73f4257033c590c868506ed0a0aa7a29

    • Size

      1.6MB

    • MD5

      73f4257033c590c868506ed0a0aa7a29

    • SHA1

      bf288989eec6aa6a6f4bb2696d189d08d268e0db

    • SHA256

      cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b

    • SHA512

      27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392

    • SSDEEP

      24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks