General

  • Target
    Invoice.exe
  • Size 613KB
  • Sample220426-e662cabaa2
  • SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Family
  • xloader

Version
  • 2.5

Campaign
  • gfge

Decoy
  • loopcoalition.com

  • hd126.com

  • elioguion.net

  • defitrader.academy

  • exactemi.com

  • angeloacierno.com

  • range4tis.com

  • ilovekuduro.us

  • mydealsstation.com

  • jerichoprinting.com

  • birdcafe605.com

  • freemansrepublic.com

  • driedplasma.com

  • valuableconnect.com

  • anthonyvid.xyz

  • theydo.support

  • devnetsecops.com

  • cryptork.tech

  • ufheur678.store

  • lavenderspa586.com

Targets

    • Target
      Invoice.exe
    • Size 613KB
    • SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
    • MD5 SHA1 SHA512
    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks