General

  • Target
    9311-32400.pdf.exe
  • Size 663KB
  • Sample210322-ef6mxhgwcs
  • SHA256 8f5dfe8e291d0fd6aa44d6b06358b1f571f9c1a6172ca2f82a2db10327d0dee8
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

C2
  • http://www.gym-gain.bid/i9p8/

Decoy
  • urbanfoxwellness.com

  • localmarket.delivery

  • nishimoguima.com

  • ai5m.net

  • thethreetees.com

  • mentactics.com

  • socksnclips.com

  • maymarmarine.com

  • northdakotapaintparties.com

  • sellyourtimesharesafe.com

  • lubangpc.com

  • nembilauktion.com

  • careersatsap.xyz

  • paradiseminks.com

  • comotowing.com

  • joananacho.com

  • beijingcameracrew.com

  • aspiringeyephoto.com

  • glprintmedia.com

  • veloxfleet.net

Targets

    • Target
      9311-32400.pdf.exe
    • Size 663KB
    • SHA256 8f5dfe8e291d0fd6aa44d6b06358b1f571f9c1a6172ca2f82a2db10327d0dee8
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks