General

  • Target
    Statement01202202_000000000000001020010201021020010.pdf.exe
  • Size 426KB
  • Sample220103-ej316sbaa5
  • SHA256 f80dd0bf7402bebd03d303c97c8dd3f921d3e923a2521f4a2af2e4bf3c288aa1
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • b556

Decoy
  • infinitephoenix.space

  • karo-tasty.com

  • suddennnnnnnnnnnn25.xyz

  • casamentorafaissa.com

  • gstfranchisecenter.com

  • privateerspace.space

  • mersuapuku.quest

  • advancebits.club

  • naturevaidh.com

  • thegiftingtree.online

  • reeronsales.com

  • paustral.com

  • diemondistro.com

  • sportytimefitness.com

  • kixevent.com

  • 0686n.com

  • okokav3.xyz

  • vitaymuhendislik.com

  • howisyourday807.rest

  • japanroofing.net

Targets

    • Target
      Statement01202202_000000000000001020010201021020010.pdf.exe
    • Size 426KB
    • SHA256 f80dd0bf7402bebd03d303c97c8dd3f921d3e923a2521f4a2af2e4bf3c288aa1
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks