General
-
Target
vbc.exe
-
Size
845KB
-
Sample
220125-vqvalsbear
-
MD5
0becd341e0585b0c5a278e62a9727a9a
-
SHA1
71b8b08ab44bb93a2bacb3948a8dee5273f78488
-
SHA256
ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e
-
SHA512
9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
Targets
-
-
Target
vbc.exe
-
Size
845KB
-
MD5
0becd341e0585b0c5a278e62a9727a9a
-
SHA1
71b8b08ab44bb93a2bacb3948a8dee5273f78488
-
SHA256
ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e
-
SHA512
9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-