General
-
Target
overdue invoices_20220101.exe
-
Size
241KB
-
Sample
220113-j8z32aggdq
-
MD5
9505909b3c7ac59c6add4d72cd69ecd6
-
SHA1
3bb605a936ddb336de13fadd922b8be9634db0a6
-
SHA256
d1a716b9f2d3c4be4527b077dd5da726ffb4008935c7223116a3aa64b4f5f8f0
-
SHA512
0ba143e6ba24d25514ede89ffa97933309772f0c40c3d9eb9ae3e31dfecfc217e6712abda33f6105db33bd94cbfa816a9520d61dfd3f003022032c25fe9c657b
Malware Config
Extracted
xloader
2.5
igwa
listingswithalex.com
funtabse.com
aydenwalling.com
prochal.net
superfoodsnederland.com
moldluck.com
dianekgordon.store
regionalhomescommercial.com
mysecuritymadesimple.com
malwaremastery.com
kodaikeiko.com
jrzg996.com
agricurve.net
songlingjiu.com
virginianundahfishingclub.com
friendschance.com
pastelpresents.com
answertitles.com
survival-hunter.com
nxfddl.com
Targets
-
-
Target
overdue invoices_20220101.exe
-
Size
241KB
-
MD5
9505909b3c7ac59c6add4d72cd69ecd6
-
SHA1
3bb605a936ddb336de13fadd922b8be9634db0a6
-
SHA256
d1a716b9f2d3c4be4527b077dd5da726ffb4008935c7223116a3aa64b4f5f8f0
-
SHA512
0ba143e6ba24d25514ede89ffa97933309772f0c40c3d9eb9ae3e31dfecfc217e6712abda33f6105db33bd94cbfa816a9520d61dfd3f003022032c25fe9c657b
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-