General
-
Target
PO_#10292132.exe
-
Size
377KB
-
Sample
211029-jeyywahehj
-
MD5
026df37a937471af093a3e8bc8636b7b
-
SHA1
57d0b25b3dd1d648c710c3ff5e44041d39d0cafc
-
SHA256
28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148
-
SHA512
6efdd2b07055c93e9b18d169ed5f5a9d9aca550b76874ff36c1d6dc8687942bb401916463b85e410def704cdacb8e58d4311336605976bb3426439d557c698c0
Malware Config
Extracted
xloader
2.5
op08
http://www.jjmpestman.com/op08/
youva.online
bbyyn1.xyz
cuttizy.com
octoorder.com
empiredigitaldating.com
giuseppedelcampo.com
kingstons.info
kwanta.info
soulworkerrush.com
sookrit.com
flambeauxartpottery.com
360metaverse.online
adnilm.com
interiordesignhampshire.com
bitpaynumber.support
aliancafm.com
tivohub.xyz
xn--ucy193f.com
smartmapom.com
thelifeofrileyelizabeth.com
Targets
-
-
Target
PO_#10292132.exe
-
Size
377KB
-
MD5
026df37a937471af093a3e8bc8636b7b
-
SHA1
57d0b25b3dd1d648c710c3ff5e44041d39d0cafc
-
SHA256
28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148
-
SHA512
6efdd2b07055c93e9b18d169ed5f5a9d9aca550b76874ff36c1d6dc8687942bb401916463b85e410def704cdacb8e58d4311336605976bb3426439d557c698c0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-