General
-
Target
PO#4500491796.r15
-
Size
664KB
-
Sample
210903-hcftvafgel
-
MD5
eeb21f96e0076da082f3739f649133b4
-
SHA1
c05b58cb71249361af3e3ca4efb468412cb0d966
-
SHA256
e255f15f5259558788630152afacc7dc83c6c3967c14ee3e41319c9c9816aed9
-
SHA512
d4d6aa8b2687b9e378d18272e0bfc753c2b415afec7d80d43d651e4967fafff0eecc0c36f4e87394c2aa8b8d2c153f6d7500808a5709cf8439ed0f15dca99546
Malware Config
Extracted
xloader
2.3
n58i
http://www.mack3sleeve.com/n58i/
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
PO#4500491796.exe
-
Size
944KB
-
MD5
e5d92d9d8c8b6bea5fff7c0fb1c2e21a
-
SHA1
46ffd28bced83a839042d7a49e30b8821fdaa353
-
SHA256
35517ca8e7a66a88a7243724e6c374d0a4a82878792536087f746bf33ab2bddf
-
SHA512
393ed37b97aa04abc7c92f4d7ba92725c5f33441f5747d6c9939ccce998c207c6e7fc8c657a2523fed56ebeddfffcf0cd57822b922f8c30a2aeb080a5fefc2e3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-