General
-
Target
BANK INFORMATION-M017012022-017016.gz
-
Size
241KB
-
Sample
220117-qb2zpaaehq
-
MD5
b1481f20840ab024ab0f729b3e0abf0a
-
SHA1
4844b5ce2e49cc085f88c379ad40f5d8dc9f6e11
-
SHA256
58b2919ca7c0f12320fc3508db29aba5cbd7d36d134903aa8333abe9f54d1728
-
SHA512
29368c9e9c1f8f4fbfab2ff7b4494af6e893f80135812e8df6be6330682c6e93ed66eaa55fe381b4beecdd133c4a5ca4660895762a3709adc85898f014d5a5e2
Malware Config
Extracted
xloader
2.5
be4o
neonewway.club
kuanghong.club
7bkj.com
ooo-club.com
kamchatka-agency.com
sjsndtvitzru.mobi
noireimpactcollective.net
justbe-event.com
easypeasy.community
southcoast.glass
janhenningsen.com
jmxyjj.com
tarihibilet.com
nagradi7.com
percentrostered.net
certvaxid.com
kingseafoodsydney.com
blacksheepwalk.com
waktuk.com
inteligenciaenrefrigeracion.com
Targets
-
-
Target
BANK INFORMATION-M017012022-017016.pdf.exe
-
Size
268KB
-
MD5
70efe8387b56122c7dd699f2721e29a9
-
SHA1
4e4d75d7bcd6507b8739a9e5b5c835d317396aab
-
SHA256
b24fe0dd0ec4d61ac6903f6579d59dcffd17d0e002c96803a551aa3ab17367ef
-
SHA512
f4fa953a6571b7c42e5a99df2a0365407011e93d60442924c6798b6ed064ab01b31e2751cd4f30909aff3b7b782abe79dfbd2c12e9ff7665244c343bca246f1e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-