General
-
Target
RFQ_293.xlsx
-
Size
440KB
-
Sample
211028-mxkezsfhel
-
MD5
0c9056f4d1c364a1b86c2cbd4d2f9010
-
SHA1
1f7436322f2a5602bef4a97779aa4e66e6d82405
-
SHA256
dd3ab4cca36bd08f8d95b6d2f6fe654c555febebdc5ca5558ef577448ebf7567
-
SHA512
1d203764f4c31b08ca01d9f75623f042f5156737b506057f3e609ac4e1b9333c9981a09fc979a608b1de2b77bd1f7e65777c785b9982921d671cfbc21a072907
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
Targets
-
-
Target
RFQ_293.xlsx
-
Size
440KB
-
MD5
0c9056f4d1c364a1b86c2cbd4d2f9010
-
SHA1
1f7436322f2a5602bef4a97779aa4e66e6d82405
-
SHA256
dd3ab4cca36bd08f8d95b6d2f6fe654c555febebdc5ca5558ef577448ebf7567
-
SHA512
1d203764f4c31b08ca01d9f75623f042f5156737b506057f3e609ac4e1b9333c9981a09fc979a608b1de2b77bd1f7e65777c785b9982921d671cfbc21a072907
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-