General
-
Target
VESSEL BOOKING DETAILS_pdf.exe
-
Size
245KB
-
Sample
210810-g5v38fs4ss
-
MD5
cf3a28df3cd2682651ced75c40b06155
-
SHA1
df85d8f256b8fd779d660f633eca94a7ea6c3cea
-
SHA256
3357b4a89dc623781355fe7a673329975777b2a5ce8a2051c538dcb7d4969c8e
-
SHA512
89c8d75516d889c8993abe926ddf5713e4fe207d459dafffa01d90df01e7f7fea63ffa0ca7428d15b0940f01c9290706c776b0b2461e160cebe2eb23a097b3b5
Malware Config
Extracted
xloader
2.3
b6a4
http://www.miraculousventures.com/b6a4/
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
Targets
-
-
Target
VESSEL BOOKING DETAILS_pdf.exe
-
Size
245KB
-
MD5
cf3a28df3cd2682651ced75c40b06155
-
SHA1
df85d8f256b8fd779d660f633eca94a7ea6c3cea
-
SHA256
3357b4a89dc623781355fe7a673329975777b2a5ce8a2051c538dcb7d4969c8e
-
SHA512
89c8d75516d889c8993abe926ddf5713e4fe207d459dafffa01d90df01e7f7fea63ffa0ca7428d15b0940f01c9290706c776b0b2461e160cebe2eb23a097b3b5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-