General
-
Target
060c2f-rundll32.exe
-
Size
366KB
-
Sample
220113-tld76abdel
-
MD5
0789de01663a113fd853dc3ee29581ae
-
SHA1
d0833aad9b9f97a5e609fe6574e24689bb246796
-
SHA256
060c2f164a53cf74817b9b2f176d770dbde8b1ef71fe5322abf9ae8197232b7d
-
SHA512
af301ec3c4005cbb5842e8a344a6a8b09dc687180df3309f71d8fd7b8aa1b6724ef7bd55ee5eaec7f785fa4aacf8307d4c1df813aaeb66aa07211a6f2b30432e
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
060c2f-rundll32.exe
-
Size
366KB
-
MD5
0789de01663a113fd853dc3ee29581ae
-
SHA1
d0833aad9b9f97a5e609fe6574e24689bb246796
-
SHA256
060c2f164a53cf74817b9b2f176d770dbde8b1ef71fe5322abf9ae8197232b7d
-
SHA512
af301ec3c4005cbb5842e8a344a6a8b09dc687180df3309f71d8fd7b8aa1b6724ef7bd55ee5eaec7f785fa4aacf8307d4c1df813aaeb66aa07211a6f2b30432e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE APT-C-23 Activity (GET)
suricata: ET MALWARE APT-C-23 Activity (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-