General
-
Target
tmp
-
Size
520KB
-
Sample
220514-sn41xscggp
-
MD5
47811f527386f1024081701f3812deb7
-
SHA1
16934d7dbc4ad5f583f3721e180c0669a57c5c84
-
SHA256
508cb22224be3ffe5f189767b150490b717fdfbbdea4ea41c3a1add4ecfe7730
-
SHA512
df060d3d595f6da2a25f54c8ecf4398bbe83c3bc39f15c258f3a984a77578389019095355f082adb9a4921390bf53c2c06b098cb7a9639ef1c13cc343fcc4f03
Malware Config
Extracted
xloader
2.5
r87g
gzjyjzsj.com
rapibest.com
affordablebathroomsbyfrank.net
roboruben.com
xn--dlisucr-byag.com
encoreasso.com
piscire.com
dixiebusybee.com
newrome.xyz
sunshinejon.com
glacierforfcs.xyz
borhanmarket.com
tous-des-cons.club
hsfstea.com
spiniform.info
vaicomfibra.com
shinigami.xyz
kryptoindia.com
listentoappetite.com
securepplpay.com
Targets
-
-
Target
tmp
-
Size
520KB
-
MD5
47811f527386f1024081701f3812deb7
-
SHA1
16934d7dbc4ad5f583f3721e180c0669a57c5c84
-
SHA256
508cb22224be3ffe5f189767b150490b717fdfbbdea4ea41c3a1add4ecfe7730
-
SHA512
df060d3d595f6da2a25f54c8ecf4398bbe83c3bc39f15c258f3a984a77578389019095355f082adb9a4921390bf53c2c06b098cb7a9639ef1c13cc343fcc4f03
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-