General
-
Target
reg.exe
-
Size
421KB
-
Sample
211202-rk5mlshehl
-
MD5
6054a52000e12227158d5da6410896c5
-
SHA1
91b7c607dcac68260ca4175d21372796614269d5
-
SHA256
4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499
-
SHA512
291c418844648231b70e9886563e7d44d1ae9427b16adadee7004a0a121dfe73610fbc9a53dbf7e266b8a2809ced38fff7071403dba18790f05031bddcf864ae
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
Targets
-
-
Target
reg.exe
-
Size
421KB
-
MD5
6054a52000e12227158d5da6410896c5
-
SHA1
91b7c607dcac68260ca4175d21372796614269d5
-
SHA256
4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499
-
SHA512
291c418844648231b70e9886563e7d44d1ae9427b16adadee7004a0a121dfe73610fbc9a53dbf7e266b8a2809ced38fff7071403dba18790f05031bddcf864ae
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-