General
-
Target
GE00006892.xlsx
-
Size
820KB
-
Sample
211213-sk9f8sehdp
-
MD5
567248278e09cf6968be5471122aa38a
-
SHA1
32220dfb875eb221eb1a33ae77e43cc08e07748f
-
SHA256
630cda95d9be61fb7bd3bddc4aacde78cc7c5a92dc303e0b354a2f81e2c4a855
-
SHA512
66093e80a786043762da533c30f882e5894397945f3a418b4da30949ac95faf1e5daf4bb79dc7d59837366f844daa0a808b6c67f042df3e757251ec474975964
Malware Config
Extracted
xloader
2.5
fqiq
http://www.esyscoloradosprings.com/fqiq/
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
GE00006892.xlsx
-
Size
820KB
-
MD5
567248278e09cf6968be5471122aa38a
-
SHA1
32220dfb875eb221eb1a33ae77e43cc08e07748f
-
SHA256
630cda95d9be61fb7bd3bddc4aacde78cc7c5a92dc303e0b354a2f81e2c4a855
-
SHA512
66093e80a786043762da533c30f882e5894397945f3a418b4da30949ac95faf1e5daf4bb79dc7d59837366f844daa0a808b6c67f042df3e757251ec474975964
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-