General
-
Target
T2812A.r11
-
Size
323KB
-
Sample
211029-n316cshhgr
-
MD5
6a1c7256d8a418c11e20eae8d25ebf9a
-
SHA1
324fabcdba9c53b253b0942ab5c3c0e2b27c8ad6
-
SHA256
9d669c62373e85e0a950edffebc9e17eb682708192df5d05226590a822f81486
-
SHA512
7f3022f191f391ce04b795565aea787f6ff1ab283f4d5125d0d03cd541e7cebf854b4297cce797079004c8ee218be8d5aae4b02fa5fb646292ca1614c5015a90
Malware Config
Extracted
xloader
2.5
snec
http://www.go2payme.com/snec/
sacramentoscoop.com
auroraeqp.com
ontactfactory.com
abenakigroup.com
xander-tech.com
cocaineislegal.com
carbondouze.com
louisvilleestatelawyer.com
sundaytejero.quest
arti-faqs.com
thisandthat.store
biodyne-el-salvador.com
18504seheritageoakslane.com
mfialias.xyz
whitestoneclo.com
6288117.com
oficiosuy.com
autogift.xyz
wallbabyshell.com
chaletlabaie.com
Targets
-
-
Target
T2812A.exe
-
Size
380KB
-
MD5
a18f3c54efed2e42168d6748a5c04c16
-
SHA1
4aa01a7a9557d15ef251e1bd107ec821872549b1
-
SHA256
724908fa2c546fad14d2a687c9f471f75548903b2d94fb903d617570cedaef7f
-
SHA512
dcb020ff28a6d694a9c4e2eaf097413f4085f8f51663958defdbe465c1592e95a518063d2d401bae392363eacf1e4ab5a2e7993ac3f541fb8c4e4eb322ad6733
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-