General
-
Target
Request for Quotation.exe
-
Size
205KB
-
Sample
210508-7e9v4eyhve
-
MD5
a464acd5b3a7def21690a99978d7bf42
-
SHA1
6b3b29a4675c4ce774c65f6b832fa0162e8dfb3b
-
SHA256
7bcbf4813256ce1a199f54f824f5e337a6ab4709287dcfa78f0cb24392e735a9
-
SHA512
4569ae903139750900068f7a1808a6f0d3f65917c62bb1e24bab3d422a96090746e12e7446ba0f7065c0da37d48cfe01706a12313e0d47db9a89137d81223dba
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
Targets
-
-
Target
Request for Quotation.exe
-
Size
205KB
-
MD5
a464acd5b3a7def21690a99978d7bf42
-
SHA1
6b3b29a4675c4ce774c65f6b832fa0162e8dfb3b
-
SHA256
7bcbf4813256ce1a199f54f824f5e337a6ab4709287dcfa78f0cb24392e735a9
-
SHA512
4569ae903139750900068f7a1808a6f0d3f65917c62bb1e24bab3d422a96090746e12e7446ba0f7065c0da37d48cfe01706a12313e0d47db9a89137d81223dba
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-