General
-
Target
DHL_119040 Belegdokument,pdf.exe
-
Size
58KB
-
Sample
211023-f7pzwsdagn
-
MD5
d64f5d6117d03dfb20cfa1555d0f4bd8
-
SHA1
1eed6ad06babb331a39b711a8f8c69902a2f4600
-
SHA256
ca08a2e70dac67086919a22c1b4bdf3f0f2578cb446ca74c8e599f71d0849e55
-
SHA512
6de1a2c97823dc026b0008fd6bb648d617ae92ef062483f81960717cc4c82efaadc214824d16ad18180c5eae6150a51cfaade227efc6d584c640c1c6c8588210
Malware Config
Extracted
xloader
2.5
g8ne
http://www.melindair.xyz/g8ne/
freesiacreations.com
ecopolymer.group
ahb9.com
ramapuramholdings.com
urban-gourmets.com
8xaocu.xyz
lancasteremerald.com
aktau.group
thebeachseekers.com
ki5rod.com
nmsships.com
dppu56.com
hairwegoca.net
aratakablogz.com
staunchgomkdt.xyz
leslaw.us
restaurantperladelmare.com
martensakcio.com
motherssecret.store
deersolutionsfranchising.com
Targets
-
-
Target
DHL_119040 Belegdokument,pdf.exe
-
Size
58KB
-
MD5
d64f5d6117d03dfb20cfa1555d0f4bd8
-
SHA1
1eed6ad06babb331a39b711a8f8c69902a2f4600
-
SHA256
ca08a2e70dac67086919a22c1b4bdf3f0f2578cb446ca74c8e599f71d0849e55
-
SHA512
6de1a2c97823dc026b0008fd6bb648d617ae92ef062483f81960717cc4c82efaadc214824d16ad18180c5eae6150a51cfaade227efc6d584c640c1c6c8588210
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-