General
-
Target
nAIj8iSBKtENT6y.exe
-
Size
411KB
-
Sample
210916-m2gvnafgeq
-
MD5
799febf0e89864960c7f98b546cea32c
-
SHA1
2a16ca50e68593db49450672e54ec8a977239a02
-
SHA256
39c5b29df15e13a18cbc4b77a44208aa927af8851555a4d220d8af0be7aeb235
-
SHA512
f6f89a2c4c36b4ca961934cb55eec8dbedf15d1a05d77387d9259ddc436766b248865e83e70341c1403dff325185e0a0f4cf51021e682adef19080a7cad6129a
Malware Config
Extracted
xloader
2.4
t75f
http://www.438451.com/t75f/
ice-lemon.pro
ar3spro.cloud
9055837.com
fucksociety.net
prettyofficialx.com
mfxw.xyz
relationshipquiz.info
customia.xyz
juanayjuan.com
zidiankj.com
facture-booking.com
secondmining.store
aboutyou.club
gongxichen.com
laurabraincreative.com
pierrot-bros.com
saintpaulaccountingservices.com
dom-maya.com
garderobamarzen.net
la-salamandre-assurances.com
Targets
-
-
Target
nAIj8iSBKtENT6y.exe
-
Size
411KB
-
MD5
799febf0e89864960c7f98b546cea32c
-
SHA1
2a16ca50e68593db49450672e54ec8a977239a02
-
SHA256
39c5b29df15e13a18cbc4b77a44208aa927af8851555a4d220d8af0be7aeb235
-
SHA512
f6f89a2c4c36b4ca961934cb55eec8dbedf15d1a05d77387d9259ddc436766b248865e83e70341c1403dff325185e0a0f4cf51021e682adef19080a7cad6129a
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-