General
-
Target
Page-1029382393.exe
-
Size
480KB
-
Sample
220131-pdrq3ahbbk
-
MD5
2d6983ca4172cd59f90949443d4b5596
-
SHA1
06ec7184a82223036b85743cdf988f2166fbb4c7
-
SHA256
547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
-
SHA512
541fc96ee9d4727a2c0980c8553a54285cc511cf3298d5ca07f53340a0e2da493324aead0035433b9bf4fc31cb646de7127921f02e4a4fb334dfc87999859024
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
Targets
-
-
Target
Page-1029382393.exe
-
Size
480KB
-
MD5
2d6983ca4172cd59f90949443d4b5596
-
SHA1
06ec7184a82223036b85743cdf988f2166fbb4c7
-
SHA256
547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
-
SHA512
541fc96ee9d4727a2c0980c8553a54285cc511cf3298d5ca07f53340a0e2da493324aead0035433b9bf4fc31cb646de7127921f02e4a4fb334dfc87999859024
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Sets service image path in registry
-
Deletes itself
-
Suspicious use of SetThreadContext
-