General
-
Target
SHIPPING DOCUMENTS.EXE
-
Size
50KB
-
Sample
220126-zepyzaabbl
-
MD5
9856b9dcbe55777dc78532fbb170ff64
-
SHA1
96f764731753aafd6682fe9f4adcca85b0b2244d
-
SHA256
63d8b5ed48256724991369af3d390fca0bba9afcc1d1dee674b6484632ed8ab5
-
SHA512
7ec1b57f9f79e831b58e5f5052f1619b8d3b1cc4c9fe787942a0f818315ab788d0814565732ce9636741d2c59584d9da2315af4347d675721f2e1daf2c8cebd0
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
SHIPPING DOCUMENTS.EXE
-
Size
50KB
-
MD5
9856b9dcbe55777dc78532fbb170ff64
-
SHA1
96f764731753aafd6682fe9f4adcca85b0b2244d
-
SHA256
63d8b5ed48256724991369af3d390fca0bba9afcc1d1dee674b6484632ed8ab5
-
SHA512
7ec1b57f9f79e831b58e5f5052f1619b8d3b1cc4c9fe787942a0f818315ab788d0814565732ce9636741d2c59584d9da2315af4347d675721f2e1daf2c8cebd0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-