General
-
Target
Fatura - Ex#35175382.pdf.exe
-
Size
228KB
-
Sample
210823-qjrnryx7qa
-
MD5
3f79af5c415898c279c6d5f76e8dd710
-
SHA1
6d633461533eca9413ef699b7e68d245261a88c9
-
SHA256
10a451fc1e7687549d6e116dd5ff984f3468de4dcc6e1494ed16c6c501668eb6
-
SHA512
d6fb55e05ab09f5aee47a51764db246c9d0d4762fe006479c437b7536f14dce14d58213ccf87cab5ab61c419b1520e4631bae7bf9860609fbe8945e782ccb9e4
Malware Config
Extracted
xloader
2.3
mabs
http://www.heehan.com/mabs/
joiderqm.com
hyc306.com
ouchplus.asia
abrosnm3.com
hospitalanti-infectives.com
ala-co.com
morrisonltts.net
tradingimpulse.com
invisibleimagination.com
jdjshop.com
huntedby.com
szsgfdzx.com
germfightersusaiowa.com
pahaadpost.com
obrankers.com
plaeralum.com
getfitwithmeministry.com
smartswaploan.com
gypsyjewelrydesigns.com
meetgoodwill.info
Targets
-
-
Target
Fatura - Ex#35175382.pdf.exe
-
Size
228KB
-
MD5
3f79af5c415898c279c6d5f76e8dd710
-
SHA1
6d633461533eca9413ef699b7e68d245261a88c9
-
SHA256
10a451fc1e7687549d6e116dd5ff984f3468de4dcc6e1494ed16c6c501668eb6
-
SHA512
d6fb55e05ab09f5aee47a51764db246c9d0d4762fe006479c437b7536f14dce14d58213ccf87cab5ab61c419b1520e4631bae7bf9860609fbe8945e782ccb9e4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-