Resubmissions
14-03-2022 13:53
220314-q7ffkagbb2 1014-03-2022 13:10
220314-qev1jshfal 1014-03-2022 13:10
220314-qejmhsffd9 114-03-2022 13:09
220314-qeba5sffd4 114-03-2022 13:09
220314-qdstsshegp 125-02-2022 17:41
220225-v9edhaabek 1025-02-2022 17:33
220225-v49x8aabcr 1025-02-2022 17:26
220225-vz7masggh9 1025-02-2022 17:01
220225-vjlpwsggd5 10General
-
Target
INV21029.EXE
-
Size
577KB
-
Sample
220314-qev1jshfal
-
MD5
740dd9c14dea0b98df6ad434abfe789e
-
SHA1
cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
-
SHA256
35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
-
SHA512
66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
Targets
-
-
Target
INV21029.EXE
-
Size
577KB
-
MD5
740dd9c14dea0b98df6ad434abfe789e
-
SHA1
cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
-
SHA256
35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
-
SHA512
66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-