General
-
Target
BANK INFORMATION-M0025012022-971332pdf.exe
-
Size
58KB
-
Sample
220125-sqrhlshgcm
-
MD5
df12e9394a0b6fe9e3af1d48a7d77c7f
-
SHA1
e2dfa81e1dd7c50ff86506e09c60f3883bb37b7c
-
SHA256
c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e
-
SHA512
6c58320b3fc059145d40e9fbb4d84762dfadd5871d392ad647e530e00e7f8db23220dca68358987ec70aedab9f237d40151fd3a8509701207ebb36c240a5e7d7
Malware Config
Extracted
xloader
2.5
be4o
neonewway.club
kuanghong.club
7bkj.com
ooo-club.com
kamchatka-agency.com
sjsndtvitzru.mobi
noireimpactcollective.net
justbe-event.com
easypeasy.community
southcoast.glass
janhenningsen.com
jmxyjj.com
tarihibilet.com
nagradi7.com
percentrostered.net
certvaxid.com
kingseafoodsydney.com
blacksheepwalk.com
waktuk.com
inteligenciaenrefrigeracion.com
Targets
-
-
Target
BANK INFORMATION-M0025012022-971332pdf.exe
-
Size
58KB
-
MD5
df12e9394a0b6fe9e3af1d48a7d77c7f
-
SHA1
e2dfa81e1dd7c50ff86506e09c60f3883bb37b7c
-
SHA256
c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e
-
SHA512
6c58320b3fc059145d40e9fbb4d84762dfadd5871d392ad647e530e00e7f8db23220dca68358987ec70aedab9f237d40151fd3a8509701207ebb36c240a5e7d7
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-