General
-
Target
DOC.exe
-
Size
688KB
-
Sample
210830-c7nvc7vyws
-
MD5
5045cebda11fea245cfa92e2cc406119
-
SHA1
69512164421d2b9f911f66837cda9f1e18dd86c9
-
SHA256
1575d06ca2a52c1ff60058d6fba43712c2926ecd3f640710ed8f96ec3aaf57da
-
SHA512
c7febf7bd68c01f0471e2359d5db921745b096d441e35aa5384d98de7dc1a50549aaac70714fd9ab91c40e45b824425a2ff1b31f171b1d88de52d7849f5fc50c
Malware Config
Extracted
xloader
2.3
n58i
http://www.mack3sleeve.com/n58i/
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
DOC.exe
-
Size
688KB
-
MD5
5045cebda11fea245cfa92e2cc406119
-
SHA1
69512164421d2b9f911f66837cda9f1e18dd86c9
-
SHA256
1575d06ca2a52c1ff60058d6fba43712c2926ecd3f640710ed8f96ec3aaf57da
-
SHA512
c7febf7bd68c01f0471e2359d5db921745b096d441e35aa5384d98de7dc1a50549aaac70714fd9ab91c40e45b824425a2ff1b31f171b1d88de52d7849f5fc50c
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-