General
-
Target
DHL Shipment Doc.exe
-
Size
817KB
-
Sample
220126-rr18rseca9
-
MD5
53af702f438bffc2adb85ae9f5b8c879
-
SHA1
e6aae502e5ea273f1367efd874bf44745d409549
-
SHA256
95ebd87f0d2e1ef1fdbf4e35290a0e9deb65b021acf657e396e960142e80eedb
-
SHA512
4e67eaaff0c8c2297b2f31040debf32b74048aa7deb8bb9498368d19966108400c12592b55e0a29bd173271b6b8d120fac5b2d1096cf318cf7edcba1527e1283
Malware Config
Extracted
xloader
2.5
how6
wealthcabana.com
fourfortyfourcreations.com
cqqcsy.com
bhwzjd.com
niftyfashionrewards.com
andersongiftemporium.com
smarttradingcoin.com
ilarealty.com
sherrywine.net
fsecg.info
xoti.top
pirosconsulting.com
fundapie.com
bbgm4egda.xyz
legalfortmyers.com
improvizy.com
yxdyhs.com
lucky2balls.com
panelmall.com
davenportkartway.com
Targets
-
-
Target
DHL Shipment Doc.exe
-
Size
817KB
-
MD5
53af702f438bffc2adb85ae9f5b8c879
-
SHA1
e6aae502e5ea273f1367efd874bf44745d409549
-
SHA256
95ebd87f0d2e1ef1fdbf4e35290a0e9deb65b021acf657e396e960142e80eedb
-
SHA512
4e67eaaff0c8c2297b2f31040debf32b74048aa7deb8bb9498368d19966108400c12592b55e0a29bd173271b6b8d120fac5b2d1096cf318cf7edcba1527e1283
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-