General
-
Target
Proforma Invoice.xlsx
-
Size
340KB
-
Sample
211014-l2sfqaggck
-
MD5
947f80a51a696c2551a5ff228a947254
-
SHA1
d7a8275cbdc8dc9b028e0d4468d8df226fceb3c6
-
SHA256
9906dd4438f55bb5839669d16d9ade577d6beb95d86a88aa77f2d262f0100270
-
SHA512
a6fd6136fa78541d9a4d180cfc8763f49e4167e7cc0038e70ed2a30139639e9485796844fdbfa7b31fbe7a3718ae0ee084f4e1d2dbb34fc445da5838d20d5dc2
Malware Config
Extracted
xloader
2.5
ht08
http://www.septemberstockevent200.com/ht08/
joye.club
istanbulemlakgalerisi.online
annikadaniel.love
oooci.com
curebase-test.com
swisstradecenter.com
hacticum.com
centercodebase.com
recbi56ni.com
mmj0115.xyz
sharpstead.com
sprklbeauty.com
progettogenesi.cloud
dolinum.com
amaroqadvisors.com
traininig.com
leewaysvcs.com
nashhomesearch.com
joy1263.com
serkanyamac.com
Targets
-
-
Target
Proforma Invoice.xlsx
-
Size
340KB
-
MD5
947f80a51a696c2551a5ff228a947254
-
SHA1
d7a8275cbdc8dc9b028e0d4468d8df226fceb3c6
-
SHA256
9906dd4438f55bb5839669d16d9ade577d6beb95d86a88aa77f2d262f0100270
-
SHA512
a6fd6136fa78541d9a4d180cfc8763f49e4167e7cc0038e70ed2a30139639e9485796844fdbfa7b31fbe7a3718ae0ee084f4e1d2dbb34fc445da5838d20d5dc2
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-