General
-
Target
Nova narudzba u prilogu.zip
-
Size
293KB
-
Sample
230403-kg1e6afa9x
-
MD5
888481963e05449a34ec1a1cd5ced47c
-
SHA1
5d001988e2860c90377416d998d4e2b2c604dfb0
-
SHA256
63b9c63ea01eda5d85837c78e26d10282c4b2a4bb98685eeace7c06a3b313650
-
SHA512
ea512772edc9783aec366c70709416e2642b469598b8bcc76bfe9acd565421d7e661274adcb66a5be9ad8b56894ec8a692ca28b6138e1db8c5cde06416b568dc
-
SSDEEP
6144:0AO86u0sqTDYQS4r+v/jvU4hqppoOXtYZBLnab0Hcb9J+35:bO8/0vT3Br+3js4hq7vXOXLaCcbaJ
Malware Config
Extracted
xloader
2.6
uj3c
copimetro.com
choonchain.com
luxxwireless.com
fashionweekofcincinnati.com
campingshare.net
suncochina.com
kidsfundoor.com
testingnyc.co
lovesoe.com
vehiclesbeenrecord.com
socialpearmarketing.com
maxproductdji.com
getallarticle.online
forummind.com
arenamarenostrum.com
trisuaka.xyz
designgamagazine.com
chateaulehotel.com
huangse5.com
esginvestment.tech
Targets
-
-
Target
Nova narudzba u prilogu.exe
-
Size
602KB
-
MD5
e827a30064936b58c6f789623317f491
-
SHA1
79ce624d096ae63e68f3ac5c1096684130b7e609
-
SHA256
1d8e5ebbfd116c875add08d4a4b4a37ef0361b28f9e9cbfd0690bc81206338c6
-
SHA512
c516e1253da0b6e65662fb297558f09763114ca0804755f66a4b4985cfe37a7988d4087f956556514036a62b5783c8fe140b18b23c9d746c40590359fca647ea
-
SSDEEP
6144:WdE8uEDkEfQQvbaGrYddRe+51qjREwCZfc7RO5E4Z1eFEZpIismTxg9FromA2Rl:X8lDAjGrc7G2wCSOn1kOpIiteSmvf
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
ModiLoader Second Stage
-
Xloader payload
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-