General
-
Target
F2123122_quantity_increased,pdf.exe
-
Size
790KB
-
Sample
210505-acc5zjwvbe
-
MD5
d973b6745ca038d514b04f5495348027
-
SHA1
23a7a5dd2bad6931c491e15244bffb19e6d975fa
-
SHA256
d390d8a528c62a458cb66745b0245eaf4721c9e3f3cea7ba75d16fae31a392b4
-
SHA512
6869f55bcbc8259360c3a967a627c61bfbb872d2504258c39c4f22043ac1d04e954bb250a7fcba035dce5e486d689dfe985bafd07dd4ae0a32e90e68b7e5b72e
Malware Config
Extracted
xloader
2.3
http://www.liancaiwangv5.com/oerg/
brightly-common.com
petwellness.pet
oldhamluxury.com
cmpembroidery.com
physicalrobot.com
irynazumba.com
testyourself11.com
theblacksportswoman.com
mottestertraining.agency
confrontinghate.info
tamiigun.com
pod14.club
implementnowsolutions.net
letsdance.website
cashforkeysdz.net
grupoprotecsasac.com
kol-lek-tiv.net
funeralhomesmaroail.com
lwfunding.com
junkglobal.com
Targets
-
-
Target
F2123122_quantity_increased,pdf.exe
-
Size
790KB
-
MD5
d973b6745ca038d514b04f5495348027
-
SHA1
23a7a5dd2bad6931c491e15244bffb19e6d975fa
-
SHA256
d390d8a528c62a458cb66745b0245eaf4721c9e3f3cea7ba75d16fae31a392b4
-
SHA512
6869f55bcbc8259360c3a967a627c61bfbb872d2504258c39c4f22043ac1d04e954bb250a7fcba035dce5e486d689dfe985bafd07dd4ae0a32e90e68b7e5b72e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-