General
-
Target
DHL Delivery Documents PDF.exe
-
Size
278KB
-
Sample
220202-z3b21sbefn
-
MD5
e9fff61eda3e215d51499c06e5391937
-
SHA1
6d8bb4e47d7466e4f8621b59417a143e309c3682
-
SHA256
82ca37f8d0b630ec22f7b60a7ce6e5e8490ca703f240b0db10b2e6e014c5d4ab
-
SHA512
9e4fb9b1b63a3fce44eb754caf53bb954b3bd423ffc5d59c59fd18bdf64331d4750b0a01c1d133351674a5187a5d822ca24f60f07dd2833f0d0ea35ef6d11cd3
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
DHL Delivery Documents PDF.exe
-
Size
278KB
-
MD5
e9fff61eda3e215d51499c06e5391937
-
SHA1
6d8bb4e47d7466e4f8621b59417a143e309c3682
-
SHA256
82ca37f8d0b630ec22f7b60a7ce6e5e8490ca703f240b0db10b2e6e014c5d4ab
-
SHA512
9e4fb9b1b63a3fce44eb754caf53bb954b3bd423ffc5d59c59fd18bdf64331d4750b0a01c1d133351674a5187a5d822ca24f60f07dd2833f0d0ea35ef6d11cd3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-