General
-
Target
SHIPPING DOCUMENT.xlsx
-
Size
348KB
-
Sample
211028-mpjhqafhdq
-
MD5
d06a6959f9509d332146ec0eb044e1ed
-
SHA1
a064afda4a92f851f09be30cee6bd2bdeed6e483
-
SHA256
521964cfa8b86e5b68055ebc945e1c9f269579c7bdcc67cadddd74914671a86d
-
SHA512
386fed9a54c60e9716d861d5897c018dcad76ebc12c86b6712230229b862696411088cd142691426af24efca6e1f190d83cb0c97aebd575229a22240dfe36065
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
Targets
-
-
Target
SHIPPING DOCUMENT.xlsx
-
Size
348KB
-
MD5
d06a6959f9509d332146ec0eb044e1ed
-
SHA1
a064afda4a92f851f09be30cee6bd2bdeed6e483
-
SHA256
521964cfa8b86e5b68055ebc945e1c9f269579c7bdcc67cadddd74914671a86d
-
SHA512
386fed9a54c60e9716d861d5897c018dcad76ebc12c86b6712230229b862696411088cd142691426af24efca6e1f190d83cb0c97aebd575229a22240dfe36065
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-