General
-
Target
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
-
Size
991KB
-
Sample
211013-yelqwaehgr
-
MD5
a65b1815177ef9eba7e5e894bbf65a3c
-
SHA1
5459ecf044e62bfb53220d0e78a5b98c24f17e25
-
SHA256
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
-
SHA512
0f05d5e05d51fbe5289330ca2c5486c49369728005c6d19b548d3f419fbf52f25aa50007271b315636aedb311a43485989e4f6de8154869d0ac7affb0f0e3db1
Malware Config
Extracted
xloader
2.5
ht08
http://www.septemberstockevent200.com/ht08/
joye.club
istanbulemlakgalerisi.online
annikadaniel.love
oooci.com
curebase-test.com
swisstradecenter.com
hacticum.com
centercodebase.com
recbi56ni.com
mmj0115.xyz
sharpstead.com
sprklbeauty.com
progettogenesi.cloud
dolinum.com
amaroqadvisors.com
traininig.com
leewaysvcs.com
nashhomesearch.com
joy1263.com
serkanyamac.com
Targets
-
-
Target
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
-
Size
991KB
-
MD5
a65b1815177ef9eba7e5e894bbf65a3c
-
SHA1
5459ecf044e62bfb53220d0e78a5b98c24f17e25
-
SHA256
298d542746dfa4922dd5fbc8fab572be58447c9dbd1481c55bd2254bb275684f
-
SHA512
0f05d5e05d51fbe5289330ca2c5486c49369728005c6d19b548d3f419fbf52f25aa50007271b315636aedb311a43485989e4f6de8154869d0ac7affb0f0e3db1
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-