General
-
Target
Shipment Advise 20035506.exe
-
Size
684KB
-
Sample
210830-e38t9f71cx
-
MD5
73a3ea879432d4dde94f127853025919
-
SHA1
354a543f9ec40cbf8dc62847da905b0b22ad804f
-
SHA256
112816e3c681b862208badf3069a7108fb356effaeab80d0235b613e653d9da5
-
SHA512
67e2f54e370d7d9e21a366cf6082ae736a564a3c419a3883cc8671cea003839a5f0f8bb7def3ee6297d15efbbd8556b04d50569e6a9a954b6694e63e11408fcb
Malware Config
Extracted
xloader
2.3
n58i
http://www.mack3sleeve.com/n58i/
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
Shipment Advise 20035506.exe
-
Size
684KB
-
MD5
73a3ea879432d4dde94f127853025919
-
SHA1
354a543f9ec40cbf8dc62847da905b0b22ad804f
-
SHA256
112816e3c681b862208badf3069a7108fb356effaeab80d0235b613e653d9da5
-
SHA512
67e2f54e370d7d9e21a366cf6082ae736a564a3c419a3883cc8671cea003839a5f0f8bb7def3ee6297d15efbbd8556b04d50569e6a9a954b6694e63e11408fcb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Suspicious use of SetThreadContext
-