General
-
Target
87e74d70762d254ec3910f692d7dd369b11c2d8747ec3ddca384a05a0121a813
-
Size
208KB
-
Sample
220206-3apn7acgf7
-
MD5
b80d9de52a4f975c301abf67078249aa
-
SHA1
02a21a515437d341793a6018ddf45848a36d7855
-
SHA256
87e74d70762d254ec3910f692d7dd369b11c2d8747ec3ddca384a05a0121a813
-
SHA512
f1261355f44d09f88fa9aee0bf619a382053ba742ae672cb5f8d4c7654aa9fb14d0b86fe1c649eefcd40f83eec1c41fe854912028ea9f905628923a2b61bda79
Malware Config
Extracted
xloader
2.3
xgxp
sin7799.com
konkondwa.com
fixmylot.com
redbirdscottsdale.com
cotcoservices.com
jonwcvxw.com
scotthaeberletriathlon.com
bob816.com
pinukimgood.life
ambitiondurable-ce.com
jioholdingscorp.com
thisisadreamright.com
asaptebal.xyz
sloanehealth.com
huugmooren.com
birdsbarber.supply
albeider.com
theperfectcolour.com
alibabulilmhouston.com
chaing-list.xyz
Targets
-
-
Target
Invoice-0898764_pdf.exe
-
Size
223KB
-
MD5
69864e354848c81e0b8c52aa201a8e1b
-
SHA1
7cbc031e83f665b0c84f97075fcff0747023e59f
-
SHA256
7d478663ff32b25b1a20ac1c3991a04e2c29f0ba38b7454095f4ce41de9b1dbd
-
SHA512
0837534e3dce30f4706efe86511cdf1d685f2f09f6bf6690808fdba6cb38c4821507ddfe9c96a36d77aa73fa36c0879c1f151a6e56cad59d0c0be82d012dee4d
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-