General
-
Target
575d37d2a63d12c078a3a88c0e514574570ab8be5d92aaaedd1799958e068861
-
Size
193KB
-
Sample
220520-p14ddafbdp
-
MD5
dccee7de3f70a3b2a9111139695136f9
-
SHA1
f21532158a6a6a5628c6502fd5fb0ea856474eac
-
SHA256
575d37d2a63d12c078a3a88c0e514574570ab8be5d92aaaedd1799958e068861
-
SHA512
3ae0ec5c42869b4fb695f496b223ee5fa750050fe4d48accdd1b7541ab7e6e804d42a1ab565fa14e98ba3b49685594048511bfcc4118485db5b1540829c9fe68
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
Targets
-
-
Target
575d37d2a63d12c078a3a88c0e514574570ab8be5d92aaaedd1799958e068861
-
Size
193KB
-
MD5
dccee7de3f70a3b2a9111139695136f9
-
SHA1
f21532158a6a6a5628c6502fd5fb0ea856474eac
-
SHA256
575d37d2a63d12c078a3a88c0e514574570ab8be5d92aaaedd1799958e068861
-
SHA512
3ae0ec5c42869b4fb695f496b223ee5fa750050fe4d48accdd1b7541ab7e6e804d42a1ab565fa14e98ba3b49685594048511bfcc4118485db5b1540829c9fe68
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-