General
-
Target
purchase order.ARJ
-
Size
196KB
-
Sample
210420-jg8qvlr5ce
-
MD5
3dc900bf25d8cafa65408328291c582b
-
SHA1
2f4ecd9a8e4032c4fd67846b1ef2be42ba091cc1
-
SHA256
a94e211baede7f7f1dd6d077a2386e9ac49be467b69699ede0bf4cacdb08e659
-
SHA512
f54371a4cf5549b5f5477076aabde6967a23b59122f9c7a00214853e0cafa0126e0bf0d4162c45ebbda51b64a4423b7c86f0c0eeea060a438bf248ae342bd494
Malware Config
Extracted
xloader
2.3
http://www.reisentuerkei.com/h6fe/
fortirecon.com
owlions.com
openrhodes.net
hannahjohnston.com
legacyfreshmarket.com
themedicareenroll.com
hpondsmarket.com
2manyads.com
kiralikservis.com
oxfordprinters.com
yamalo.club
apagyms.com
gulsahdevarsiv.com
employmentpakistan.com
insidegamez.com
curiget.xyz
pinturayanexo.com
myltcpool.com
greenfirewoodash.com
gabrielaalcantarperiodista.com
Targets
-
-
Target
purchase order.ARJ.exe
-
Size
210KB
-
MD5
fa96f770af00841a9138bedbba1f0277
-
SHA1
4be4790f83f34c603d9423d8feea35d7315f2ea6
-
SHA256
4b880b8ba9e0e635de04312ad9cfa89328606faa0364972cff8c61b7685f5045
-
SHA512
e60818987f2161046094b606e0a2eb46910295bad4364724295875c53ea25395c009939e96f3aea1bcbc839c74472441b53323865561f34973effd3bf9e2b67f
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-