General
-
Target
60b7ee7c678553708c9ef357f9922acea8736a66ba9109eed68a7b2680bc8c68
-
Size
1005KB
-
Sample
211029-nfnlrahhdp
-
MD5
ab88797a02acd0499d33fcaa807f46cd
-
SHA1
04ca9bc69e500239d677d46d2e53a9ef5fc69f41
-
SHA256
60b7ee7c678553708c9ef357f9922acea8736a66ba9109eed68a7b2680bc8c68
-
SHA512
61c5c1d00bcc9f9986f7da0873fc4d74d55f5abf07d6eeddfe4f787ce1b40f98bfeb86d95da968858a79d2f03340ebf538c5711b1485800fa2958a0e4221e365
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
Targets
-
-
Target
60b7ee7c678553708c9ef357f9922acea8736a66ba9109eed68a7b2680bc8c68
-
Size
1005KB
-
MD5
ab88797a02acd0499d33fcaa807f46cd
-
SHA1
04ca9bc69e500239d677d46d2e53a9ef5fc69f41
-
SHA256
60b7ee7c678553708c9ef357f9922acea8736a66ba9109eed68a7b2680bc8c68
-
SHA512
61c5c1d00bcc9f9986f7da0873fc4d74d55f5abf07d6eeddfe4f787ce1b40f98bfeb86d95da968858a79d2f03340ebf538c5711b1485800fa2958a0e4221e365
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-