General
-
Target
ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f
-
Size
253KB
-
Sample
220511-jqxj7agbc5
-
MD5
148b63c2b85f806c7c3036f854b1c6f0
-
SHA1
43b8071712dc21a04140a2eae003380b7575f7e8
-
SHA256
ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f
-
SHA512
b16af075fc1a9569d6898d58f623a8af277b09543130afaf9e21a710032d1545c42b37530514cb0d080ed3afcc028317573ae5cdd7c2fac5bbb87e0ac80f99d2
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
Targets
-
-
Target
ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f
-
Size
253KB
-
MD5
148b63c2b85f806c7c3036f854b1c6f0
-
SHA1
43b8071712dc21a04140a2eae003380b7575f7e8
-
SHA256
ca4112bb9a7b776f14e9085c5b3ecaa7458ecaaa4c2515b79978d7f99eca768f
-
SHA512
b16af075fc1a9569d6898d58f623a8af277b09543130afaf9e21a710032d1545c42b37530514cb0d080ed3afcc028317573ae5cdd7c2fac5bbb87e0ac80f99d2
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-