General
-
Target
BANK SLIP.exe
-
Size
50KB
-
Sample
220126-kywtasbbfq
-
MD5
28273f7b22cd7d7625539756195eed22
-
SHA1
af5b5b284248e26a77a471374afe38434d40cd7e
-
SHA256
12dfafbf527adac369abdc31bfe9756517c70b2216a12ef4f4772eba15eaa2e2
-
SHA512
3dd8d3ae0a8bee444ca01477959ee466f5c54c39f5f2a3b5591f2a1142a9eb6300d9f0fd9253095929d81e2364668cdfd974f06580c2bf57aab72c611d97ee51
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
BANK SLIP.exe
-
Size
50KB
-
MD5
28273f7b22cd7d7625539756195eed22
-
SHA1
af5b5b284248e26a77a471374afe38434d40cd7e
-
SHA256
12dfafbf527adac369abdc31bfe9756517c70b2216a12ef4f4772eba15eaa2e2
-
SHA512
3dd8d3ae0a8bee444ca01477959ee466f5c54c39f5f2a3b5591f2a1142a9eb6300d9f0fd9253095929d81e2364668cdfd974f06580c2bf57aab72c611d97ee51
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-