General
-
Target
UPDATED e-STATEMENT..exe
-
Size
872KB
-
Sample
210921-e5dneaafgm
-
MD5
a3279da350cf134f736629e5e55c0a41
-
SHA1
d28cc3a2cc3e16cf38634cab8db41aacebf4709b
-
SHA256
fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
-
SHA512
248040d33716b6f7fb5c0764380c67489d2acdc52784b2d8020faa57f09edc383ab7ecd85c297ef2516698e2cfa92e7d8edc8fc0c510263e5a2b91e1f650d79b
Malware Config
Extracted
xloader
2.5
c2ue
http://www.heidevelop.xyz/c2ue/
isportdata.com
stellarex.energy
hsucollections.com
menuhaisan.com
joe-tzu.com
lumichargemktg.com
uae.tires
rapidcae.com
softwaresystemsolutions.com
s-galaxy.website
daewon-talks.net
northgamesnetwork.com
catalogue-bouyguestele.com
criativanet.com
theseasonalshift.com
actionfoto.online
openmaildoe.com
trashpenguin.com
ennopure.net
azurermine.com
Targets
-
-
Target
UPDATED e-STATEMENT..exe
-
Size
872KB
-
MD5
a3279da350cf134f736629e5e55c0a41
-
SHA1
d28cc3a2cc3e16cf38634cab8db41aacebf4709b
-
SHA256
fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
-
SHA512
248040d33716b6f7fb5c0764380c67489d2acdc52784b2d8020faa57f09edc383ab7ecd85c297ef2516698e2cfa92e7d8edc8fc0c510263e5a2b91e1f650d79b
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-