General
-
Target
purchase order RYP-210720.xlsx
-
Size
1.4MB
-
Sample
210830-2eqqye4lpn
-
MD5
4ddcef3dc2b64260444ea0d7eab89ff6
-
SHA1
0c8b18807dc813333c7f3ed420044a5b52798060
-
SHA256
edf47643570963890ad63265b1884882a471f000ce9d4a681dd5cdfb8efdc53b
-
SHA512
d809a8c7be2c0f718df8121f57f51adeb3de4ff5e764c1470efeb85882098ba93510ea9c041ca45c826de3c9411346caad0e6773d381c28e6ce6b6d9819bbbea
Malware Config
Extracted
xloader
2.3
ecuu
http://www.polaritelibrairie.com/ecuu/
buoy8boats.com
tomrings.com
o-distribs.com
majesticgroupinc.com
tehridam.com
yzwjtoys.com
castro-online.run
aquarius-twins.com
jamesrrossfineart.com
pavarasupatthonkol.com
rivermarketdentistry.com
gyiblrjd.icu
redcountrypodcast.com
youngbrotherspharmacyga.com
betsysobiech.com
neocleanpro.com
ingpatrimoine.com
mustangsallytransportation.com
jsvfcxzn.com
krsfpjuoekcd.info
Targets
-
-
Target
purchase order RYP-210720.xlsx
-
Size
1.4MB
-
MD5
4ddcef3dc2b64260444ea0d7eab89ff6
-
SHA1
0c8b18807dc813333c7f3ed420044a5b52798060
-
SHA256
edf47643570963890ad63265b1884882a471f000ce9d4a681dd5cdfb8efdc53b
-
SHA512
d809a8c7be2c0f718df8121f57f51adeb3de4ff5e764c1470efeb85882098ba93510ea9c041ca45c826de3c9411346caad0e6773d381c28e6ce6b6d9819bbbea
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-