General
-
Target
SHIPPING DOCUMENT.xlsx
-
Size
440KB
-
Sample
211026-psgveahde8
-
MD5
d2ae6b73790fbea52fb38ca9efbfff00
-
SHA1
43a3960fbaeccd56106634a306989bbbb37d9fe7
-
SHA256
b8677b241250c8d529fe496afdc597980e502533c8bb71a602451a2336c9e2bc
-
SHA512
d29a653f2098b33b9bf993db46c791546fb00e95fd094c5ba298d163d94633c224ddfa6303e9aad4710159ed95e93a5ab9fdb74367fc2fc0390449dc1e9a6d47
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
Targets
-
-
Target
SHIPPING DOCUMENT.xlsx
-
Size
440KB
-
MD5
d2ae6b73790fbea52fb38ca9efbfff00
-
SHA1
43a3960fbaeccd56106634a306989bbbb37d9fe7
-
SHA256
b8677b241250c8d529fe496afdc597980e502533c8bb71a602451a2336c9e2bc
-
SHA512
d29a653f2098b33b9bf993db46c791546fb00e95fd094c5ba298d163d94633c224ddfa6303e9aad4710159ed95e93a5ab9fdb74367fc2fc0390449dc1e9a6d47
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-