General
-
Target
DHL_119040 documento de recibo de la compra,pdf.exe
-
Size
147KB
-
Sample
211022-yrjgaadabj
-
MD5
34675091ac031b8c43327239a1929dd0
-
SHA1
38984bb6cc0e96425cdfd3fb67592a9e4670b6ca
-
SHA256
cbf031a1dbedd7a1e8f5b158cd6f9af3995fb4e815caee4723fc3ab03b900b19
-
SHA512
f96def8a574e0142391f13f7c4f783a31df633b306d3514247b055c86ffa6814b9492f4baf1c2ecc97cdb25927693a9d7b3f07b8b82ea06b62ac10a1c8a9936a
Malware Config
Extracted
xloader
2.5
b65i
http://www.onewebuy.net/b65i/
leofighters.com
smartat2.xyz
encontrevariedades.com
jimwilliamstutoring.com
kanpaiecuador.com
accura-inv.com
xtzgjxzz.com
scentstrategies.com
high-clicks2.com
hadishgebray.com
woodlawnbailbonds.com
dmsolutionsco.com
rdvulm21.com
beachyweens.com
ishirmansingh.com
rimmasbracelets.com
kellibrat.com
roselmasm.com
datkamoney.info
fermers.club
Targets
-
-
Target
DHL_119040 documento de recibo de la compra,pdf.exe
-
Size
147KB
-
MD5
34675091ac031b8c43327239a1929dd0
-
SHA1
38984bb6cc0e96425cdfd3fb67592a9e4670b6ca
-
SHA256
cbf031a1dbedd7a1e8f5b158cd6f9af3995fb4e815caee4723fc3ab03b900b19
-
SHA512
f96def8a574e0142391f13f7c4f783a31df633b306d3514247b055c86ffa6814b9492f4baf1c2ecc97cdb25927693a9d7b3f07b8b82ea06b62ac10a1c8a9936a
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-