General
-
Target
Purchase Order# 210145.r15
-
Size
499KB
-
Sample
210904-jbwdkseaa6
-
MD5
670970e38874328d9be066888d99430c
-
SHA1
4c13349fc38971c9b8e6a05736f2f70351cd58aa
-
SHA256
9c525994932a57f0b3c5582a3b0f929a7c87a410c34648656870c757a3fdde3e
-
SHA512
d77319f471b9c83e595fc446bc8cff9c34ddcd53d90d8253d4edf77bc1e62591ec5d3a030e87db1aab67cda7539b3c003e0cd2120ffd8e88f21e554e12c290e8
Malware Config
Extracted
xloader
2.3
n58i
http://www.mack3sleeve.com/n58i/
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
Purchase Order# 210145.exe
-
Size
603KB
-
MD5
7a9cf63d76a9013b241c538061e457e3
-
SHA1
f694dec9c2b83cb06887d7996031e69b748af9eb
-
SHA256
28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83
-
SHA512
822424d5ddd757cfc07b4cc99f8500f2f37884bb594e89b96bab63b6ada87c9105e8dfc500973b2c3c02354642d647a6d3be14b5fd1033ec1f513fed3ec16b02
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-