General
-
Target
draft shippng document CI+PL.xlsx
-
Size
369KB
-
Sample
211021-gw3x2shhe2
-
MD5
543702f3a378e0b065e79ff956fa25f5
-
SHA1
de898adcab0fcfeb5a1a5d281a688371de1e930a
-
SHA256
d9456bea4f1151ba05cdee82e2370acce666812a57dbf6f73f7b5b25bf814819
-
SHA512
48325b58371735b147c4301b9582433c9a5f7fe4f29af5bdf1c74f746b119e8a842e48e1289f4541285f18110e1f7a8bfd9624a0ea5441da9d844acc80bda6e5
Malware Config
Extracted
xloader
2.5
bs8f
http://www.rwilogisticsandbrokerage.com/bs8f/
vasilnikov.com
parkate.club
pol360.com
handmadequatang.com
consult-set.com
nourkoki.com
theveganfusspot.com
dreamssail.com
pinpinyouqian.xyz
satellitphonestore.com
yotosunny.com
telosaolympics.com
gogetemm.com
yozotnpasumo2.xyz
avantgardemarket.com
glenndcp.com
dirtydriverz.com
avaui.com
anchoredtheblog.com
marianaoliveiraarquitetura.com
Targets
-
-
Target
draft shippng document CI+PL.xlsx
-
Size
369KB
-
MD5
543702f3a378e0b065e79ff956fa25f5
-
SHA1
de898adcab0fcfeb5a1a5d281a688371de1e930a
-
SHA256
d9456bea4f1151ba05cdee82e2370acce666812a57dbf6f73f7b5b25bf814819
-
SHA512
48325b58371735b147c4301b9582433c9a5f7fe4f29af5bdf1c74f746b119e8a842e48e1289f4541285f18110e1f7a8bfd9624a0ea5441da9d844acc80bda6e5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-