General
-
Target
Payment Advice.gz
-
Size
94KB
-
Sample
220119-pjxjhahffn
-
MD5
12a525327f00e22382fbecdf23cd536f
-
SHA1
3028727e5fdd62e3bed766c69367bf8543a99698
-
SHA256
b0b986ed5654b0bc08243773c2c57558c3d1e1158f6744eafd7c9357bf2d401c
-
SHA512
de139c4a4b304f3310be08ecd50d2565f6f3a47573ba0793e3ebed08e4fcd9977ac417a72fdbde461d722fa51aade6b00c4319b538d3f30d9a020d12bb2bb309
Malware Config
Extracted
xloader
2.5
be4o
neonewway.club
kuanghong.club
7bkj.com
ooo-club.com
kamchatka-agency.com
sjsndtvitzru.mobi
noireimpactcollective.net
justbe-event.com
easypeasy.community
southcoast.glass
janhenningsen.com
jmxyjj.com
tarihibilet.com
nagradi7.com
percentrostered.net
certvaxid.com
kingseafoodsydney.com
blacksheepwalk.com
waktuk.com
inteligenciaenrefrigeracion.com
Targets
-
-
Target
Payment Advice.pdf.exe
-
Size
370KB
-
MD5
5cda0b468d4136fb19e1f79c258acbb9
-
SHA1
0cb7a1174cf5d5a7089c8ed585c5e670974b9048
-
SHA256
fa5511f4b07ca39be9b04bee49a2b103cf827a207d316d4d41bad9cede43c9bc
-
SHA512
e05c563a4caf8aa1def8febbe0042cd97b8b08ff2c6a69215610b321fb77132f6f9f6d804cba0d2cc060e7d81789d379475b03b107087555f717809f51784f44
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-