General
-
Target
INVPRF2100114_pdf.xz
-
Size
337KB
-
Sample
211008-dhxmbsdcgl
-
MD5
f2b7dabf7931bdb818687d491423c3c2
-
SHA1
316b410d92f5719b43313acf1e5dddf2d578ddcd
-
SHA256
c74bf1b4c0ffc5f4606080565ccb160bff27a505c468730e0d833f363494970c
-
SHA512
5011c1b4fb6ff49c6a4a3c74f0c0f45e51ff454d2e1c84b03600d5515133998071fdf8f41d038684ca9629be9540a5d7cc82900ead6c556031dff0d740520a38
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
Targets
-
-
Target
INVPRF2100114_pdf.exe
-
Size
412KB
-
MD5
08be9eb13ce48889a767c1faf80fc855
-
SHA1
4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9
-
SHA256
7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737
-
SHA512
5ccbdf445507b85c5b4595b430e26b5306d30abfe60047f5d2438a3294013a93cbf8d1136ab009b1cda87a5f662fb8ca5683a11ecb60a9636a0c2155c6d9d3b4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-