General
-
Target
Bill Of Lading & Packing List.pdf.gz
-
Size
193KB
-
Sample
210501-mhw693vr9a
-
MD5
e3491d32da391c4da1127c296a3cb4d3
-
SHA1
508f2b7d7417afe641be4b7c0182bd12d523b13e
-
SHA256
6b92dd05b73397369b13a8f5244ce67f0fa29953ed7d4cbdcbd48fd1097239aa
-
SHA512
a6d3068e26d18d03a618acfa95e0fe826dd8c97e1d7b9f68762be4e53dc549d111bd39a5b30c4b89d11f088de1addf18d34afcbef865062f91c3fd2ccf3766c7
Malware Config
Extracted
xloader
2.3
http://www.citestaccnt1597666144.com/ud9e/
casezs.com
gascubby.com
pekodains.com
superskosh.com
avktinfracon.com
slink.finance
thegreathopeofearth.com
thebattleofthestars.com
utmxpxq.icu
mamaandbabycleaningservice.com
officialtimelessbeauty.com
keeper.network
leyingcp.com
helpforharrysheroes.com
cohenforleehealthboard.com
wsilhavy.net
logisticsconsultinglimited.com
btechnician.com
dynamicpersiankitten.com
nuplaz.com
Targets
-
-
Target
raw file.exe
-
Size
207KB
-
MD5
8fa3305b6265fa3c61f58ce580b07f54
-
SHA1
2123a32738d6f92cd893c7a67603e14042c849b6
-
SHA256
18ff6408798a94561e9fc4f6fb43dcc279b9b98a554e5cd26ab1944f7b75e35a
-
SHA512
296a848fb00a4e9b52ee02c761f5e9eb1d973b52aa60d1ac03a9decfe4e4202a0e04f315c334846f15ce6aef65ded028c5a93a87a1d84861c7b376db6602971a
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-