General
-
Target
scan doc_o1022111234.exe
-
Size
285KB
-
Sample
220120-m71jyshfhj
-
MD5
69ee93123716e7d21e0e527be980c22b
-
SHA1
bb4b074dda0d143d36a6c4c572bd669be67fe0e5
-
SHA256
3866d4f2f3fa6a3cdedd0b3e4704b438881b0a147e75eeddacaeea85e52c669a
-
SHA512
36925cddedff3acb9a217ce35e8d676a46d76f5873471daf9e9cf512f2df5934fe263532b0ba789573fdc887eb211eee6cbe0988b8e22306d16ff211509c1edc
Malware Config
Extracted
xloader
2.5
cxep
estateglobal.info
loransstore.com
loginofy.com
fjallravenz.online
cefseguranca-app.com
safontadiestramiento.com
bubbleteapro.com
morethanmummies.com
serviciopersonalizadoweb.com
headerbidder.info
skworkforce.com
heightsorthodontics.com
chulavistapd.com
southjerseyautobody.net
chargedbygratitude.com
meltingpotspot.com
gdjiachen.com
luckdrawprogram.com
vintagepaseo.com
bequestslojyh.xyz
Targets
-
-
Target
scan doc_o1022111234.exe
-
Size
285KB
-
MD5
69ee93123716e7d21e0e527be980c22b
-
SHA1
bb4b074dda0d143d36a6c4c572bd669be67fe0e5
-
SHA256
3866d4f2f3fa6a3cdedd0b3e4704b438881b0a147e75eeddacaeea85e52c669a
-
SHA512
36925cddedff3acb9a217ce35e8d676a46d76f5873471daf9e9cf512f2df5934fe263532b0ba789573fdc887eb211eee6cbe0988b8e22306d16ff211509c1edc
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-