General
-
Target
vbc.exe
-
Size
512KB
-
Sample
210914-qg66laagcm
-
MD5
b5f072069794e482d7a5940d8ba04a9a
-
SHA1
c09d4b4b399ff3c346103e33879f0e4bdcc2fa6a
-
SHA256
a5fb671ff149d2c1c97fcd000703037ca35298d3d45d4797ab20a190aea0ff10
-
SHA512
900cf03b996c8e553fad6f3a675222865befd9ce15d8ba186edbb2fac1ad0431bcccee23f38cb24e3d76b6b41c494f5d538f7a4ca86455b835a23c6a7672d302
Malware Config
Extracted
xloader
2.3
b6cu
http://www.allfyllofficial.com/b6cu/
sxdiyan.com
web0084.com
cpafirmspokane.com
la-bio-geo.com
chacrit.com
stuntfighting.com
rjsworkshop.com
themillennialsfinest.com
thefrontrealestate.com
chairmn.com
best1korea.com
gudssutu.icu
backupchip.net
shrikanthamimports.com
sportrecoverysleeve.com
healthy-shack.com
investperwear.com
intertradeperu.com
resonantonshop.com
greghugheslaw.com
Targets
-
-
Target
vbc.exe
-
Size
512KB
-
MD5
b5f072069794e482d7a5940d8ba04a9a
-
SHA1
c09d4b4b399ff3c346103e33879f0e4bdcc2fa6a
-
SHA256
a5fb671ff149d2c1c97fcd000703037ca35298d3d45d4797ab20a190aea0ff10
-
SHA512
900cf03b996c8e553fad6f3a675222865befd9ce15d8ba186edbb2fac1ad0431bcccee23f38cb24e3d76b6b41c494f5d538f7a4ca86455b835a23c6a7672d302
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Deletes itself
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-