General
-
Target
Narudzbenica je u prilogu.zip
-
Size
657KB
-
Sample
220119-z6r8eadcep
-
MD5
6cd7ee9ec80c4c438db877ffe060de48
-
SHA1
d1b4d3f19ef229a10569b89fee58b0c81c0d52f7
-
SHA256
2d2a5ffbfae8e20597b95296146dcbe004ddd18f825beb90507c19c04bc58ad0
-
SHA512
9e0a6f7ea9e09e658b9f770e8768fedfb9d9fff4d11d3d35970a586fbdc30086ccceaafb3185099a7cc180cab741b513bd2662915202caa59ac1921bddcf866d
Malware Config
Extracted
xloader
2.5
pvxz
imt-token.club
abravewayocen.online
shcloudcar.com
mshoppingworld.online
ncgf08.xyz
stuinfo.xyz
wesavetheplanetofficial.com
tourbox.xyz
believeinyourselftraining.com
jsboyat.com
aaeconomy.info
9etmorea.info
purosepeti7.com
goticketly.com
pinkmemorypt.com
mylifewellnesscentre.com
iridina.online
petrestore.online
neema.xyz
novelfooditalia.com
Targets
-
-
Target
Narudzbenica je u prilogu.exe
-
Size
1.1MB
-
MD5
3f62f0e33ae2d3e5a974c44e48b1911b
-
SHA1
0f67db19211488d41ff1a864e468df388467405f
-
SHA256
434b7ce0d1ae84c361a987e1990bfe0ba031db5d8b094022f8e8c2cb23fb2cda
-
SHA512
4bdc0a3901f5ce50c09f635608d4c1b96928cd4e1c71cb977d4a329e9b0cde827274c29c422729b984fab04ca360ac7486b02390526cf69a47d66f0e80e82018
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-