General
-
Target
TNT Original Invoice.exe
-
Size
759KB
-
Sample
220215-x4yw3aafgm
-
MD5
03fe2e5b5e59253d0815b2e121fa1e30
-
SHA1
eed9bbbb504bf208449c764fece9ccec3f23e771
-
SHA256
08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0
-
SHA512
a032b27abca34d611e4073453e04d9b2ffcfec8c239eca5aa10203117013b1b872031ac9ac42ebb174acd8acf49f6a1505940826e1900eef05fca1cf6ba6f09c
Malware Config
Extracted
xloader
2.5
zqzw
laurentmathieu.com
nohohonndana.com
hhmc.info
shophallows.com
blazebunk.com
goodbridge.xyz
flakycloud.com
bakermckenziegroups.com
formation-adistance.com
lovingearthbotanicals.com
tbrservice.plus
heritagehousehotels.com
drwbuildersco.com
lacsghb.com
wain3x.com
dadreview.club
continiutycp.com
cockgirls.com
48mpt.xyz
033skz.xyz
Targets
-
-
Target
TNT Original Invoice.exe
-
Size
759KB
-
MD5
03fe2e5b5e59253d0815b2e121fa1e30
-
SHA1
eed9bbbb504bf208449c764fece9ccec3f23e771
-
SHA256
08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0
-
SHA512
a032b27abca34d611e4073453e04d9b2ffcfec8c239eca5aa10203117013b1b872031ac9ac42ebb174acd8acf49f6a1505940826e1900eef05fca1cf6ba6f09c
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-