General
-
Target
PAYMENT COPY.zip
-
Size
424KB
-
Sample
210924-m6al5sggak
-
MD5
34645d39ab18afad34d32525b2ce9a38
-
SHA1
5e54ce8770ddee8dd74c59b3d9a48a5e369c8878
-
SHA256
2fc9a61642b9083e8ae6c8674596d894fea53124bd5b210a06ab2767e37a2196
-
SHA512
889a393876378df5458ec508753ecd4f0cff003008954d9e5aa537e8c7780ab3dfab7e368273d222e7814a40d3782d994384e1b873559d3c0c4ed58291e43fd2
Malware Config
Extracted
xloader
2.5
c2ue
http://www.heidevelop.xyz/c2ue/
isportdata.com
stellarex.energy
hsucollections.com
menuhaisan.com
joe-tzu.com
lumichargemktg.com
uae.tires
rapidcae.com
softwaresystemsolutions.com
s-galaxy.website
daewon-talks.net
northgamesnetwork.com
catalogue-bouyguestele.com
criativanet.com
theseasonalshift.com
actionfoto.online
openmaildoe.com
trashpenguin.com
ennopure.net
azurermine.com
Targets
-
-
Target
PAYMENT COPY.exe
-
Size
866KB
-
MD5
24736913b455be2ed3d1cc67c767afc4
-
SHA1
8026db0f265178cf013ac579c1b7267f4014bf2c
-
SHA256
a109f0b9407728fef1b41d766e8228085ee04661156d84ef543777bf311f450b
-
SHA512
49dd3e5ecbf6d4cd310a45d0b52e36a363d701f0a9cc14a1d3c103b613eb5a756fdc9ce8b028d69b56c4c8137d29ea3d57865b4ff75dac44bf982e5c80ee56ee
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-