General
-
Target
5e9aba7aa4cb5b012889435a0bdaf3ac311ff6c7545b5c156f7c3cd3e3510f34
-
Size
253KB
-
Sample
220510-3v8ykaafh3
-
MD5
a6481e8a071be497473fd37fdabe8d83
-
SHA1
64ca16d365f80e529446583a8900b7b28d356487
-
SHA256
5e9aba7aa4cb5b012889435a0bdaf3ac311ff6c7545b5c156f7c3cd3e3510f34
-
SHA512
1c96776e99411ae50df9cbd534eba221440e6363798458d4668580a0da0dbb5bf37848aad7f19e4de04f907f784492622c88a8f9b770541e9456950b5e259b81
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
Targets
-
-
Target
5e9aba7aa4cb5b012889435a0bdaf3ac311ff6c7545b5c156f7c3cd3e3510f34
-
Size
253KB
-
MD5
a6481e8a071be497473fd37fdabe8d83
-
SHA1
64ca16d365f80e529446583a8900b7b28d356487
-
SHA256
5e9aba7aa4cb5b012889435a0bdaf3ac311ff6c7545b5c156f7c3cd3e3510f34
-
SHA512
1c96776e99411ae50df9cbd534eba221440e6363798458d4668580a0da0dbb5bf37848aad7f19e4de04f907f784492622c88a8f9b770541e9456950b5e259b81
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-