General
-
Target
Order Form.xlsx
-
Size
369KB
-
Sample
211021-gr18naagcq
-
MD5
4434e645d8eeb07c9bd8e01713b39c10
-
SHA1
12d021e0f7897023be1f07b58f9d8c8912b5e78a
-
SHA256
e9154b29bd87ce3234088a1a5f57531ec378daf59c7399fc054392a857219b22
-
SHA512
d3cd47f0d99b0c20fd332f00f6f12ab985beadc9b8ec6bd4b722a6dc220ec67e01a521c3c6f576f9813901b1ccb632c61d5e5d8ab3a007a87144c1061b50a7bf
Malware Config
Extracted
xloader
2.5
ht08
http://www.septemberstockevent200.com/ht08/
joye.club
istanbulemlakgalerisi.online
annikadaniel.love
oooci.com
curebase-test.com
swisstradecenter.com
hacticum.com
centercodebase.com
recbi56ni.com
mmj0115.xyz
sharpstead.com
sprklbeauty.com
progettogenesi.cloud
dolinum.com
amaroqadvisors.com
traininig.com
leewaysvcs.com
nashhomesearch.com
joy1263.com
serkanyamac.com
Targets
-
-
Target
Order Form.xlsx
-
Size
369KB
-
MD5
4434e645d8eeb07c9bd8e01713b39c10
-
SHA1
12d021e0f7897023be1f07b58f9d8c8912b5e78a
-
SHA256
e9154b29bd87ce3234088a1a5f57531ec378daf59c7399fc054392a857219b22
-
SHA512
d3cd47f0d99b0c20fd332f00f6f12ab985beadc9b8ec6bd4b722a6dc220ec67e01a521c3c6f576f9813901b1ccb632c61d5e5d8ab3a007a87144c1061b50a7bf
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-