General
-
Target
838bbbd9b48b401cb8d9c28671aaeba4e13358c682366a64f16e5460351c5ef4
-
Size
455KB
-
Sample
220131-vn5nkaabgj
-
MD5
fa26144142a5e69b467750ebb5afce87
-
SHA1
cfc159aa742a9270b6f8d2520be9be5be751a599
-
SHA256
838bbbd9b48b401cb8d9c28671aaeba4e13358c682366a64f16e5460351c5ef4
-
SHA512
34d5277525129f91684def49840858ea93909a46e516102dca3b92ccb3ae521b02ee8c77f7290eb7882946fbf2c4c00a676abe2b566ce9af73ec9d509b3b8b3a
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
NEW ORDER.exe
-
Size
509KB
-
MD5
99e84bd298ccb6717d194f7caf580062
-
SHA1
1f1ae4137e469593d8ee726f5eb8c5abbbc95871
-
SHA256
d99804145213694ea4b93c8acb43bf14d712b2043c247c703f88ebc97bf9c8d8
-
SHA512
9b0a01d48df348892ebfd46a07f4a21b1d399ac3462352e9b18ad56ac2624683d8982d57989ed9a594880241d39df60f50c210941c6e56b0a9af374fba7828e4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Sets service image path in registry
-
Deletes itself
-
Suspicious use of SetThreadContext
-