General
-
Target
pago pendiente.rar
-
Size
367KB
-
Sample
220126-pf2ztacffn
-
MD5
cca6e42612b8ddae13dd03641d6ceda0
-
SHA1
0e1db9a63b2c78befc1e0e10e45e7730f0c086f1
-
SHA256
7254ad698d310793a1caa4fd73c6e3b0fa01002b5a8fb71783991fe405219283
-
SHA512
7f16a33c722e1ce9e9011ef39060a2ab7060c26fa92c69e265da0f2ccdf35b9a35324d7b5a8649dea8d5c0b9571e5f4cadc680f9f8114104ca5479c14dc1197c
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
Targets
-
-
Target
4tWrWVF8FkB9IrJ.exe
-
Size
414KB
-
MD5
edcc11c57c2fb4d186e43c373e26767e
-
SHA1
9213cc1be29f552bb97312cba2d7976a682c77bb
-
SHA256
72417f2e53964171cecc3819ad3033955ef54b7eb0d7cb542fe089d4f19c5f5d
-
SHA512
efafe40f26016e6e7853b94f43431b29ce75cf14c92feba4f15cadcd9fd18080d0b770e0dbbff992616d0842c6d5d6c661151cc6776fae3cb6d2d49cb6e6476e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-