Description
Xloader is a rebranded version of Formbook malware.
Swift Copy_44000.exe
General
Target
Size
Sample
Swift Copy_44000.exe
320KB
211203-pb2s9agdhk
Score
10 /10
MD5
SHA1
SHA256
SHA512
03d853072e1cab50b55cce6883e5e72e
a3d35ebdb90c950db690d900c57b804cb4874b4e
5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c
0229de62952ebc975333eb6ec25e9d47fd7f658e44661d198d17a8b6b833291b42f4f08e7ec41e574dd2dba8d58da54c0c0375e1d764bd26fe84fc3aa70d8116
Malware Config
Extracted
| Family | xloader |
| Version | 2.5 |
| Campaign | e8ia |
| C2 |
http://www.helpfromjames.com/e8ia/ |
| Decoy |
le-hameau-enchanteur.com quantumsystem-au.club engravedeeply.com yesrecompensas.lat cavallitowerofficials.com 800seaspray.com skifun-jetski.com thouartafoot.com nft2dollar.com petrestore.online cjcutthecord2.com tippimccullough.com gadget198.xyz djmiriam.com bitbasepay.com cukierniawz.com mcclureic.xyz inthekitchenshakinandbakin.com busy-clicks.com melaniemorris.online elysiangp.com 7bkj.com wakeanddraw.com ascalar.com iteraxon.com henleygirlscricket.com torresflooringdecorllc.com helgquieta.quest xesteem.com graffity-aws.com bolerparts.com andriylysenko.com bestinvest-4-you.com frelsicycling.com airductcleaningindianapolis.net nlproperties.net alkoora.xyz sakiyaman.com wwwsmyrnaschooldistrict.com unitedsafetyassociation.com fiveallianceapparel.com edgelordkids.com herhauling.com intelldat.com weprepareamerica-planet.com webartsolution.net yiquge.com marraasociados.com dentalimplantnearyou-ca.space linemanbible.com |
Targets
Target
MD5
Filesize
Swift Copy_44000.exe
03d853072e1cab50b55cce6883e5e72e
320KB
Score
10/10
SHA1
SHA256
SHA512
a3d35ebdb90c950db690d900c57b804cb4874b4e
5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c
0229de62952ebc975333eb6ec25e9d47fd7f658e44661d198d17a8b6b833291b42f4f08e7ec41e574dd2dba8d58da54c0c0375e1d764bd26fe84fc3aa70d8116
Tags
Signatures
-
Xloader
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
Description
suricata: ET MALWARE FormBook CnC Checkin (GET)
Tags
-
Xloader Payload
Tags
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks