General

  • Target

    3a2b189ba8182eb62ea6bfc27e8ca898

  • Size

    1.3MB

  • Sample

    231231-r3qamsgbhl

  • MD5

    3a2b189ba8182eb62ea6bfc27e8ca898

  • SHA1

    4dbb07cf112a88e1a90517102d281f12825d2c83

  • SHA256

    f988c17ff348d65c83b031d164e3a3850b38f4e6b2c43cd426dfafd68474301a

  • SHA512

    e73ce3cc077a7daecc58ad8b3de749cf19cc0f8e49c516f4fca3caeb0179073984df76a2113372131d7c3873f022d7210dce49d676913b12c615663cc4cf1460

  • SSDEEP

    24576:rn+S/d3lYdkeDPEyZzgz8F59dbZt/SQIIgRmw2GPoN7vdiTbnFM:oRPE4zvF5nZt/DVgRmsPoiM

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Targets

    • Target

      3a2b189ba8182eb62ea6bfc27e8ca898

    • Size

      1.3MB

    • MD5

      3a2b189ba8182eb62ea6bfc27e8ca898

    • SHA1

      4dbb07cf112a88e1a90517102d281f12825d2c83

    • SHA256

      f988c17ff348d65c83b031d164e3a3850b38f4e6b2c43cd426dfafd68474301a

    • SHA512

      e73ce3cc077a7daecc58ad8b3de749cf19cc0f8e49c516f4fca3caeb0179073984df76a2113372131d7c3873f022d7210dce49d676913b12c615663cc4cf1460

    • SSDEEP

      24576:rn+S/d3lYdkeDPEyZzgz8F59dbZt/SQIIgRmw2GPoN7vdiTbnFM:oRPE4zvF5nZt/DVgRmsPoiM

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks