General
-
Target
PO_098765.exe
-
Size
626KB
-
Sample
210727-rw7ebq3k8s
-
MD5
564508cbfae2c08aec669e47219f9b00
-
SHA1
36f867db04e9f8a9c9b585df26ba1f4391a0ccbf
-
SHA256
f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96
-
SHA512
c35b9bc7a6662d52d570a9fcf6f825603d72471375f25598d1dd0112312c729cca0fb3089bedbb84678215e8f8a4c9770af3933aa40133edd90957e8ba36c7b4
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
Targets
-
-
Target
PO_098765.exe
-
Size
626KB
-
MD5
564508cbfae2c08aec669e47219f9b00
-
SHA1
36f867db04e9f8a9c9b585df26ba1f4391a0ccbf
-
SHA256
f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96
-
SHA512
c35b9bc7a6662d52d570a9fcf6f825603d72471375f25598d1dd0112312c729cca0fb3089bedbb84678215e8f8a4c9770af3933aa40133edd90957e8ba36c7b4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-