General

  • Target

    1b6e9d3a84cd8a419c21c776b1404e5c

  • Size

    866KB

  • Sample

    231230-rtahtshbgl

  • MD5

    1b6e9d3a84cd8a419c21c776b1404e5c

  • SHA1

    06b9dcc16006ba145835dc9746f41c537c0990b7

  • SHA256

    0382afb675f3cd67a1759d46e8ad340036fee6e54170a7037aedc163ce6f7551

  • SHA512

    f69d8e04fddbfe87465e13d9e76252d538982e427ff9efd023b1aaa7a469734f9fa30940fdbdafb50a47bb5c02b45bc639b2c425969faeaadd68e2383c525a0c

  • SSDEEP

    12288:ZxX1p+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXq+YQHw2TS:bXncnTZSFOtIaxriVoda7V7DU50m0

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

q4kr

Decoy

realmodapk.com

hanoharuka.com

shivalikspiritualproducts.com

womenshealthclinincagra.com

racketpark.com

startuporig.com

azkachinas.com

klanblog.com

linuxradio.tools

siteoficial-liquida.com

glsbuyer.com

bestdeez.com

teens2cash.com

valleyviewconstruct.com

myfortniteskins.com

cambecare.com

csec2011.com

idookap.com

warmwallsrecords.com

smartmirror.one

Targets

    • Target

      1b6e9d3a84cd8a419c21c776b1404e5c

    • Size

      866KB

    • MD5

      1b6e9d3a84cd8a419c21c776b1404e5c

    • SHA1

      06b9dcc16006ba145835dc9746f41c537c0990b7

    • SHA256

      0382afb675f3cd67a1759d46e8ad340036fee6e54170a7037aedc163ce6f7551

    • SHA512

      f69d8e04fddbfe87465e13d9e76252d538982e427ff9efd023b1aaa7a469734f9fa30940fdbdafb50a47bb5c02b45bc639b2c425969faeaadd68e2383c525a0c

    • SSDEEP

      12288:ZxX1p+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXq+YQHw2TS:bXncnTZSFOtIaxriVoda7V7DU50m0

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks