General
-
Target
PAYMENT ADVICE.exe
-
Size
822KB
-
Sample
210922-hw6jlseecl
-
MD5
24960042ad6c12059fc424d9119ebbba
-
SHA1
a5b44dc60c82a59c6eeeab63b8d38ec9ed2a171e
-
SHA256
8d536146e57d878eea148bc98170d2f7cad77ea57f0fbefedf3f3c0dcce40ac5
-
SHA512
0623ed157cad710f3eda179ece6ca41e529b1045d98e773f7252ff1dc8c7f7554a69dc6096353f2b2b5d5872ba2e59c546803169ffcaadbb483220c35fd76d03
Malware Config
Extracted
xloader
2.5
c2ue
http://www.heidevelop.xyz/c2ue/
isportdata.com
stellarex.energy
hsucollections.com
menuhaisan.com
joe-tzu.com
lumichargemktg.com
uae.tires
rapidcae.com
softwaresystemsolutions.com
s-galaxy.website
daewon-talks.net
northgamesnetwork.com
catalogue-bouyguestele.com
criativanet.com
theseasonalshift.com
actionfoto.online
openmaildoe.com
trashpenguin.com
ennopure.net
azurermine.com
Targets
-
-
Target
PAYMENT ADVICE.exe
-
Size
822KB
-
MD5
24960042ad6c12059fc424d9119ebbba
-
SHA1
a5b44dc60c82a59c6eeeab63b8d38ec9ed2a171e
-
SHA256
8d536146e57d878eea148bc98170d2f7cad77ea57f0fbefedf3f3c0dcce40ac5
-
SHA512
0623ed157cad710f3eda179ece6ca41e529b1045d98e773f7252ff1dc8c7f7554a69dc6096353f2b2b5d5872ba2e59c546803169ffcaadbb483220c35fd76d03
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-