General
-
Target
xz.exe
-
Size
163KB
-
Sample
211012-jvnsvabghq
-
MD5
3b710cc2fd2ed7c2c71e88b128cb1297
-
SHA1
cde9f5bc3064e6e84473b74c62c289e38db2f00b
-
SHA256
0c22acaa973cbb781aea92dc1fb5a8c7cc1fd2abd403f2a6b9703f8f1e1c8657
-
SHA512
a74f820a0e1a6a2db21998109ebba32ffc1abac3fc26eaabb28a891170aa5d5c0b1e893e0a215a0a285dda95bf579e91b00f93cfa8561c882ee1bb4a1faa1c50
Behavioral task
behavioral1
Sample
xz.exe
Resource
win7v20210408
Malware Config
Extracted
xloader
2.5
mjyv
http://www.simpeltattofor.men/mjyv/
wenyuexuan.com
tropicaldepression.info
healthylifefit.com
reemletenleafy.com
jmrrve.com
mabduh.com
esomvw.com
selfcaresereneneness.com
murdabudz.com
meinemail.online
brandqrcodes.com
live-in-pflege.com
nickrecovery.com
ziototoristorante.com
chatcure.com
corlora.com
localagentlab.com
yogo7.net
krveop.com
heianswer.xyz
idproslot.xyz
anielleharris.com
lebonaharchitects.com
chilestew.com
ventasdecasasylotes.xyz
welcome-sber.store
ahmedintisher.com
pastlinks.com
productprinting.online
babybox.media
volteraenergy.net
chinatowndeliver.com
behiscalm.com
totalselfconfidence.net
single-on-purpose.com
miyonbuilding.com
medicalmanagementinc.info
bellaalubo.com
dubaibiologicdentist.com
jspagnier-graveur.com
deskbk.com
thehauntdepot.com
5fbuy.com
calmingscience.com
luvnecklace.com
noun-bug.com
mysenarai.com
socialmediaplugin.com
livinglovinglincoln.com
vaxfreeschool.com
bjjinmei.com
p60p.com
upgradepklohb.xyz
georges-lego.com
lkkogltoyof4.xyz
fryhealty.com
peacetransformationpath.com
lightfootsteps.com
recreativemysteriousgift.com
luminoza.website
mccorklehometeam.com
car-insurance-rates-x2.info
serpasboutiquedecarnes.com
1971event.com
Targets
-
-
Target
xz.exe
-
Size
163KB
-
MD5
3b710cc2fd2ed7c2c71e88b128cb1297
-
SHA1
cde9f5bc3064e6e84473b74c62c289e38db2f00b
-
SHA256
0c22acaa973cbb781aea92dc1fb5a8c7cc1fd2abd403f2a6b9703f8f1e1c8657
-
SHA512
a74f820a0e1a6a2db21998109ebba32ffc1abac3fc26eaabb28a891170aa5d5c0b1e893e0a215a0a285dda95bf579e91b00f93cfa8561c882ee1bb4a1faa1c50
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-