General
-
Target
Purchase Order no.202201EYL-01.zip
-
Size
119KB
-
Sample
211121-tdya3ahae3
-
MD5
b4b8dded7dd8a47f319ebfc4354837a3
-
SHA1
1964a6729d32a91ec1c8e72fcaf5fb88cc84df51
-
SHA256
24fe031c810109d25d3c4a837291ba9ff83cd31806cfcd6fef14a1e5913760cd
-
SHA512
b316dad496d7eb0bdc6e648ca0ac2b023dd1b35c463b90d19e5de07270101e455a96d97c781e66e503b12f614681ad8fa6056132d7c5c9303f4de1cd87902ed4
Malware Config
Extracted
xloader
2.5
46uq
http://www.jixelbbk.com/46uq/
spiritueleonlinetraining.online
jrpz86.com
dataxmart.com
zeogg.club
killiandooley.com
159studios.com
clginter.com
greenwirechicago.com
kennycheng.tech
carolyngracecoaching.com
cp-altodelamuela.com
amazonflowerjewelry.com
anseron.net
surplusqlxbjy.online
asasal.com
online-buy-now.com
kolab.today
statisticsacademy.com
dcupqiu.club
braxtynmi.xyz
Targets
-
-
Target
Purchase Order no.202201EYL-01.exe
-
Size
163KB
-
MD5
bf3176a88b749246b4294096531f97ca
-
SHA1
34ae702a189c937a26dd8066466d43a3ef756b61
-
SHA256
2ff3a8569873600f75e011be4ead5896a408672e43b15008679692557f6dc6c9
-
SHA512
a75d6c7e362c06ae248b830bd91ec75730116461e7f6bc93c16ffc7c619c7eff8282a83439fffdae31ea401e6629db31ef8d36f041d6c08f353a5758c09f3327
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-