Resubmissions

09-09-2024 22:56

240909-2wsgjavbpp 10

25-05-2022 22:24

220525-2bc64sabbj 10

General

  • Target

    see7.exe

  • Size

    574KB

  • Sample

    240909-2wsgjavbpp

  • MD5

    1ccf28645e2d52556487a9710de54d8e

  • SHA1

    e83b5b14a3d08d8838e23c08070ebec713f859ef

  • SHA256

    513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

  • SHA512

    5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

  • SSDEEP

    12288:ISLCbH4ZEOJVXxLUpCS+zJMEuKr/5iCseJ7HA9oX+q6Eb1Ql2L2I:n4HMui/5FsXxq6Nl2

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Targets

    • Target

      see7.exe

    • Size

      574KB

    • MD5

      1ccf28645e2d52556487a9710de54d8e

    • SHA1

      e83b5b14a3d08d8838e23c08070ebec713f859ef

    • SHA256

      513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

    • SHA512

      5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

    • SSDEEP

      12288:ISLCbH4ZEOJVXxLUpCS+zJMEuKr/5iCseJ7HA9oX+q6Eb1Ql2L2I:n4HMui/5FsXxq6Nl2

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks