General
-
Target
QUOTATION REQUEST N� 34715383 pdf.arj
-
Size
530KB
-
Sample
210420-gd56ztxw52
-
MD5
f931ac16f9b34a82af98c8fc5fb85048
-
SHA1
f833e387947e359f0771320b32e2c2d5034fe6a5
-
SHA256
40deb6cf1fe9ba24781042c14a5ad378f877fe1c5759de5ef015ab029aa3e0ec
-
SHA512
52a4226e229c6ee081f28d5662a3eb38ac3a88f1e14dcd8aef824a313a412ce979637584f00e8f8b7fe8d613d9b38ca856c44f8d191138687f9b992fd02af838
Malware Config
Extracted
xloader
2.3
http://www.aquaroyaume.com/uabu/
khedutbajar.com
vehicleporn.com
misanthropedia.com
partum.life
tenshinstore.com
51tayi.com
rgr.one
lattakia-imbiss.com
escalerasdemetal.com
nationalurc.info
prettygalglam.com
globalperfumery.com
ivulam.xyz
qingniang.club
quick2ulube.com
curiget.xyz
ujeiakosdka.com
lacapitalcaferestaurant.com
agarkovsport.online
okashidonya.com
Targets
-
-
Target
QUOTATION REQUEST N° 34715383 pdf.exe
-
Size
610KB
-
MD5
d83b5351a96c228a773cad862ab91b50
-
SHA1
dc0850e562fd6721e04ff3ea3c8dd29797d52348
-
SHA256
c4987ae3911832fddc2a4d074d8e145673807761432b2e444e5d619eda1c5212
-
SHA512
2b149555c54bc37b73cca78b4b284b7b3ba34b6d4111c7539db0dda2f95d8f9e88bb489cebbe7cf127c9e0ad1c5efcb89451749de6a8be55041bc67c49086826
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-