Overview

overview

10

Static

static

#QUO_SMLS_...df.exe

windows7_x64

10

#QUO_SMLS_...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    #QUO_SMLS_H1130 Pdf.exe
  • Size 1018KB
  • Sample211207-efmvsaagb3
  • SHA256 719d886691ce91e7cbf30951199fb337e7ed2d1bae4c381a57da2d3802594be2
  • MD5 SHA1 SHA512
Score
10/10
xloadermwfcloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • mwfc

C2

  • http://www.malagainvestments.com/mwfc/

Decoy

  • a-great-intl-voip-phones.zone

  • police-trust-security.com

  • 415391.com

  • coi-sl.com

  • liming-steel.com

  • criticalracetheoryexplained.com

  • pintoent.com

  • columbusrx.com

  • clarktribe.net

  • texasforblanchard.com

  • musical.voyage

  • priyamblogs.com

  • employbridge.works

  • americanchessmaster.com

  • australiaaddictioncenters.com

  • drkell-yann.xyz

  • barryisdaner.com

  • frankkystein.art

  • aromatoto7.com

  • alsuwal.com

Targets

    • Target
      #QUO_SMLS_H1130 Pdf.exe
    • Size 1018KB
    • SHA256 719d886691ce91e7cbf30951199fb337e7ed2d1bae4c381a57da2d3802594be2
    • MD5 SHA1 SHA512
    Score
    10/10
    xloadermwfcloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks