General
-
Target
Order_15078.exe
-
Size
685KB
-
Sample
210727-26hqb82syn
-
MD5
c50b491461d89171d660abcc9c654171
-
SHA1
e1cc6e9512546b2a8eefd3741f52c30121be3dea
-
SHA256
6db6324fe282260a224e77fff9bdad3240a63d48ac587f2a701785ea69c317a5
-
SHA512
7589ece7798fa6affec99655d301cb23acd8a25654c0411ad6e871247a24b31653ea8b6249b6440124acb5fad5f390f73e8cbb7ee76be1970ee12f4ad27e52e0
Malware Config
Extracted
xloader
2.3
http://www.steveblexrud.com/rqe8/
bjft.net
abrosnm3.com
badlistens.com
signal-japan.com
schaka.com
kingdompersonalbranding.com
sewmenship.com
lzproperty.com
mojoimpacthosting.com
carinsurancecoverage.care
corporatemercadona.com
mobileswash.com
forevercelebration2026.com
co-het.com
bellesherlou.com
commentsoldgolf.com
onlytwod.group
utesco.info
martstrip.com
onszdgu.icu
Targets
-
-
Target
Order_15078.exe
-
Size
685KB
-
MD5
c50b491461d89171d660abcc9c654171
-
SHA1
e1cc6e9512546b2a8eefd3741f52c30121be3dea
-
SHA256
6db6324fe282260a224e77fff9bdad3240a63d48ac587f2a701785ea69c317a5
-
SHA512
7589ece7798fa6affec99655d301cb23acd8a25654c0411ad6e871247a24b31653ea8b6249b6440124acb5fad5f390f73e8cbb7ee76be1970ee12f4ad27e52e0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-