General
-
Target
RFQ_AP65425652_032421 isu-isu,pdf.exe
-
Size
388KB
-
Sample
210408-rzr1sx19te
-
MD5
98f9ea244308bb5969ea3c302c32efcd
-
SHA1
82a913894418af7834d23bc543eb286230d4edf4
-
SHA256
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
-
SHA512
c300afa9a46ca0c9d12c395c90c7bcd1950513780d4fd3775525a4f431319e16504ee3ee2411050a48810b94eb29f3c9ee84ad8c6efd2460280c7091a5923847
Malware Config
Extracted
xloader
2.3
http://www.luegomusic.com/pe0r/
quickeasybites.com
idilecup.com
atelierdusalon.com
tigerking-safe.com
goinyourstrength.com
ssfgasia.com
halmanseger.com
hpcovn.com
thegodfatherricedealer.com
hzmsbg.com
trickswithwix.com
rbvctiu.com
spystoredevices.com
monlexiem.com
apt-forward.com
medsez.cloud
nanantz.com
kf350.com
ztvwgqjya.com
countingeverything.com
Targets
-
-
Target
RFQ_AP65425652_032421 isu-isu,pdf.exe
-
Size
388KB
-
MD5
98f9ea244308bb5969ea3c302c32efcd
-
SHA1
82a913894418af7834d23bc543eb286230d4edf4
-
SHA256
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
-
SHA512
c300afa9a46ca0c9d12c395c90c7bcd1950513780d4fd3775525a4f431319e16504ee3ee2411050a48810b94eb29f3c9ee84ad8c6efd2460280c7091a5923847
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-