General
-
Target
Scan 28837646737664829193848843 pdf.exe
-
Size
1.2MB
-
Sample
220323-kydygsfdhl
-
MD5
3ebd21231dabb0ade99fee5da48309a2
-
SHA1
1df621e0616b6a0c2c5ec0acd2d27ec8ea72e097
-
SHA256
b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827
-
SHA512
c4ec1e6010bb1d78b4f342b03e415c7118d0075d162e5ae9492e056499a22a581ac5d3568c9d17522c994fcfad35f9e7d7e12ff39d15939d8cef8f552da5321a
Malware Config
Extracted
xloader
2.5
ubqk
tundrat-celltherapy.com
superfinance.club
5x5week.com
687504.com
clarkdn.com
potterypklsck.xyz
4m5k.com
21t8.com
94o2ohfjg.com
bhupendratravels.com
nomadashop.com
w388bet.bet
naturalenetwork.net
tupaqu.com
osooir.com
jengly.com
cbsharjah.icu
tokowallpaperbekasi.com
baggamut.com
upoon81.com
Targets
-
-
Target
Scan 28837646737664829193848843 pdf.exe
-
Size
1.2MB
-
MD5
3ebd21231dabb0ade99fee5da48309a2
-
SHA1
1df621e0616b6a0c2c5ec0acd2d27ec8ea72e097
-
SHA256
b10824c56d2ef6aa6af1474f898e5578bb6f6155eb4f9cd63ef3e7fd36c2a827
-
SHA512
c4ec1e6010bb1d78b4f342b03e415c7118d0075d162e5ae9492e056499a22a581ac5d3568c9d17522c994fcfad35f9e7d7e12ff39d15939d8cef8f552da5321a
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-