General
-
Target
Payment_Advice000987.exe
-
Size
1.1MB
-
Sample
210727-zq7d5nhj8s
-
MD5
ce92634fff801af8ce0a1263ce436fc0
-
SHA1
28c4d7ca4f3f3680b2d23a109c2b8934c625c219
-
SHA256
ce9fb89fadc9b872b78b1eb08bf0e160f08c00acf7de61a490de8d62a5d770de
-
SHA512
78b4976506401fe1a7d9cf2569293cd8ec97b6ea3281a5e7078d8eb5b655dd27273e6e1b57310424aa43c7d5f00e3b3541259af666ed7097f2a55c85840fa714
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
Targets
-
-
Target
Payment_Advice000987.exe
-
Size
1.1MB
-
MD5
ce92634fff801af8ce0a1263ce436fc0
-
SHA1
28c4d7ca4f3f3680b2d23a109c2b8934c625c219
-
SHA256
ce9fb89fadc9b872b78b1eb08bf0e160f08c00acf7de61a490de8d62a5d770de
-
SHA512
78b4976506401fe1a7d9cf2569293cd8ec97b6ea3281a5e7078d8eb5b655dd27273e6e1b57310424aa43c7d5f00e3b3541259af666ed7097f2a55c85840fa714
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-