General
-
Target
DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
-
Size
30KB
-
Sample
220216-w7rrgsdcer
-
MD5
c2ed847cba51543076504a7150261f22
-
SHA1
93e063e8f777b42cab7f7ed8fa45a2397942dead
-
SHA256
dfe742ea984310b86ce1d553b87e63f4cdefcf8485b7c860438234377a10a358
-
SHA512
4dca34f7a0c0ecf2018de5a0e2ba5a9145cfdac508dafa1f5de5fad4072703f6621587b164a742d094cb557e8cedba5630cd7477fbf355a6311ac457c0cb5670
Malware Config
Extracted
xloader
2.5
po6r
jnhuichuangxin.com
mubashir.art
extol.design
doyyindh.xyz
milanoautoexperts.com
4thefringe.com
453511.com
sellathonautocredit.com
velgian.com
6672pk.com
wodeluzhou.com
sumiyoshiku-hizaita.xyz
imoveldeprimeira.com
dgjssp.com
endokc.com
side-clicks.com
cashndashfinancial.com
vanhemelryck.info
agamitrading.com
woofgang.xyz
Targets
-
-
Target
DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
-
Size
30KB
-
MD5
c2ed847cba51543076504a7150261f22
-
SHA1
93e063e8f777b42cab7f7ed8fa45a2397942dead
-
SHA256
dfe742ea984310b86ce1d553b87e63f4cdefcf8485b7c860438234377a10a358
-
SHA512
4dca34f7a0c0ecf2018de5a0e2ba5a9145cfdac508dafa1f5de5fad4072703f6621587b164a742d094cb557e8cedba5630cd7477fbf355a6311ac457c0cb5670
Score10/10-
Modifies WinLogon for persistence
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-