General
-
Target
TNT Shipping Documents PDF.exe
-
Size
45KB
-
Sample
220204-e3rr9aefe7
-
MD5
749c45d83182b00ff5b9cb6394ebd3d3
-
SHA1
65ac8bfa4bdbc8dc3700af4dc79db1885d8b19e7
-
SHA256
27062e4b23fb41174e739aa21beb389d31ccd48342643e62caa28c4831a276ef
-
SHA512
85d999f419b2753bfdc98ce5539e9caa382eec32289296a9f5c481f6b47b510e6fd4c078904bce599aa6b45b7051af59e50556aabbd5d6dd850fe5a430150d2b
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
TNT Shipping Documents PDF.exe
-
Size
45KB
-
MD5
749c45d83182b00ff5b9cb6394ebd3d3
-
SHA1
65ac8bfa4bdbc8dc3700af4dc79db1885d8b19e7
-
SHA256
27062e4b23fb41174e739aa21beb389d31ccd48342643e62caa28c4831a276ef
-
SHA512
85d999f419b2753bfdc98ce5539e9caa382eec32289296a9f5c481f6b47b510e6fd4c078904bce599aa6b45b7051af59e50556aabbd5d6dd850fe5a430150d2b
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-