General

  • Target

    815a3dbde4d501e96222d6de9b0be3fc

  • Size

    1008KB

  • Sample

    240130-bqeqdagbcn

  • MD5

    815a3dbde4d501e96222d6de9b0be3fc

  • SHA1

    7dbeb3995445a6143043490dc44530f283d26afa

  • SHA256

    8402867c8ded316ffb97af7aaab3fb6cea74a31bbcf4742e614f927d98b84914

  • SHA512

    e5c03a5a7cfbf5c735e9f8e3c846bda6b42114776debea4aa9343a1b7289324601e4a5e51eedec5f252dfc1dfe4b59533087260179847de6d56b17c5038090fe

  • SSDEEP

    12288:yDAxqubTcpG5y8b61SY9UOX5xb6NQC+R9+ufQDDn1PCgj/Wn:hquIG5y8m8TOXDbbRsDbW

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Targets

    • Target

      815a3dbde4d501e96222d6de9b0be3fc

    • Size

      1008KB

    • MD5

      815a3dbde4d501e96222d6de9b0be3fc

    • SHA1

      7dbeb3995445a6143043490dc44530f283d26afa

    • SHA256

      8402867c8ded316ffb97af7aaab3fb6cea74a31bbcf4742e614f927d98b84914

    • SHA512

      e5c03a5a7cfbf5c735e9f8e3c846bda6b42114776debea4aa9343a1b7289324601e4a5e51eedec5f252dfc1dfe4b59533087260179847de6d56b17c5038090fe

    • SSDEEP

      12288:yDAxqubTcpG5y8b61SY9UOX5xb6NQC+R9+ufQDDn1PCgj/Wn:hquIG5y8m8TOXDbbRsDbW

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks