General
-
Target
64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5
-
Size
317KB
-
Sample
220223-3dmn1achar
-
MD5
9afa54ca6adc21703eafa1444d025fb1
-
SHA1
23fc1a8eafc5d8693973ffaffc223cefc1c6cc13
-
SHA256
64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5
-
SHA512
68397ef5b5eba8964b3ab440bc30bb29c26c06e63eb4154632386d6de355492e2499efc20b47b87e87b89bf31a116d5a1f6059864c99a3ac9080b295d355e65b
Malware Config
Extracted
xloader
2.5
p2a5
gorillaslovebananas.com
zonaextasis.com
digitalpravin.online
memorialdoors.com
departmenteindhoven.com
vipulb.com
ruyibao365.com
ynpzz.com
matthewandjessica.com
winfrey2024.com
janetride.com
arairazur.xyz
alltheheads.com
amayawebdesigns.com
califunder.com
blacksource.xyz
farmasi.agency
ilmkibahar.com
thinkcentury.net
eskortclub.com
Targets
-
-
Target
64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5
-
Size
317KB
-
MD5
9afa54ca6adc21703eafa1444d025fb1
-
SHA1
23fc1a8eafc5d8693973ffaffc223cefc1c6cc13
-
SHA256
64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5
-
SHA512
68397ef5b5eba8964b3ab440bc30bb29c26c06e63eb4154632386d6de355492e2499efc20b47b87e87b89bf31a116d5a1f6059864c99a3ac9080b295d355e65b
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-