General
-
Target
DELIVERY DOCUMENTS.zip
-
Size
550KB
-
Sample
220217-hvdgfaada9
-
MD5
38dfbdb166723b97bec64e979c8070c6
-
SHA1
e3f0ddcebaff193e0dc06a0362075c8aae51af32
-
SHA256
32a4deb862242950e512685a298d705eba7b656650e47c1643bf38b64ce32036
-
SHA512
6a315528873eef289ff8b6579a04f72de38b05ecc632791020607aeb3642bb3ed758ac52443cc2ebe02084befa22c1c008e0943717458e6764bc7cd51a00d63d
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
DELIVERY DOCUMENTS.exe
-
Size
707KB
-
MD5
427ef5f4e1143ad34c33b26dc4681661
-
SHA1
673fb1a58e4707ad783d03ca97b3fbd8b4cad73a
-
SHA256
cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4
-
SHA512
b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-