General
-
Target
tmp
-
Size
332KB
-
Sample
220302-th713ahbek
-
MD5
8bc5cae30e499dea0d78f85c309be304
-
SHA1
95b3af264ecfec7155002f8ee9bbc46c4946e84f
-
SHA256
ea928c88deed19528dead0fc786936f6ac102f94905ce1bff6df678b7c560726
-
SHA512
d6149bcc0747f00b53a429dbd1605433830d8f2f67d638eb5e4feb41cb43f5029f42ddeb23c369a5000d5b37896ee51cf6f79cbdc23f0848ce0a10d62901de99
Malware Config
Extracted
xloader
2.5
igwa
listingswithalex.com
funtabse.com
aydenwalling.com
prochal.net
superfoodsnederland.com
moldluck.com
dianekgordon.store
regionalhomescommercial.com
mysecuritymadesimple.com
malwaremastery.com
kodaikeiko.com
jrzg996.com
agricurve.net
songlingjiu.com
virginianundahfishingclub.com
friendschance.com
pastelpresents.com
answertitles.com
survival-hunter.com
nxfddl.com
Targets
-
-
Target
tmp
-
Size
332KB
-
MD5
8bc5cae30e499dea0d78f85c309be304
-
SHA1
95b3af264ecfec7155002f8ee9bbc46c4946e84f
-
SHA256
ea928c88deed19528dead0fc786936f6ac102f94905ce1bff6df678b7c560726
-
SHA512
d6149bcc0747f00b53a429dbd1605433830d8f2f67d638eb5e4feb41cb43f5029f42ddeb23c369a5000d5b37896ee51cf6f79cbdc23f0848ce0a10d62901de99
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-