General
-
Target
Zamówienie zakupu PO-Eu598303.exe
-
Size
235KB
-
Sample
220715-p5zwrabgdn
-
MD5
ac1429ffb0da2f0566c6d962f3726722
-
SHA1
5030c312545901872262a6c8602fef73f6e413c9
-
SHA256
38fbf4ef63938c61701107b226bef84d19a357b215830ce660101cfe6f59e75c
-
SHA512
412f250da91fa2402f20c3012e84f04c9fe353ad4d8bdd9ffdf1361e42b8008ae7104cbb88adf324070cec54f22fdd26491938329c405266f30ef403d50f53bd
Malware Config
Extracted
xloader
2.6
vweq
malang-media.com
mrsfence.com
lubetops.com
aitimedia.net
montecryptocapital.com
ahwmedia.com
bvmnc.site
bggearstore.com
bcsantacoloma.online
alltimephotography.com
santacruz-roofings.com
leaplifestyleenterprises.com
censovet.com
similkameenfarms.com
undisclosed.email
thetrinityco.com
rapiturs.com
jedlersdorf.info
mh7jk12e.xyz
flygurlblogwordpress.com
Targets
-
-
Target
Zamówienie zakupu PO-Eu598303.exe
-
Size
235KB
-
MD5
ac1429ffb0da2f0566c6d962f3726722
-
SHA1
5030c312545901872262a6c8602fef73f6e413c9
-
SHA256
38fbf4ef63938c61701107b226bef84d19a357b215830ce660101cfe6f59e75c
-
SHA512
412f250da91fa2402f20c3012e84f04c9fe353ad4d8bdd9ffdf1361e42b8008ae7104cbb88adf324070cec54f22fdd26491938329c405266f30ef403d50f53bd
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-