General
-
Target
AWB# 1022355167633.exe
-
Size
598KB
-
Sample
220603-kmklwsdgc4
-
MD5
3ac5a4a3bacfc094aabbb796c9c7d05b
-
SHA1
452d06618aeb595c3942da9bf1ad7a01ff0cda2d
-
SHA256
18e820d656b9bc40731a53a9efcd5c0866bf6d2488a0c74b7f221430003377d0
-
SHA512
0b673abb31626650698f16b94134bee5cfb7abaf53f5004ed2fd66e81d7478e259867ce6cd508c10cdc3b61da91ebd245d3ad33479f9985073bcdf754e5650d0
Malware Config
Extracted
xloader
2.6
a8hq
veteransductcleaning.com
beajtjunkies.com
houseofascofi.com
scottsdalemediator.com
atelyadesign.com
profitcase.pro
imtokenio.club
qinglingpai.com
bigsmile-meal.net
daytonlivestream.com
aspiradores10.online
ytybs120.com
hdatelier.com
bearpierce.com
yeson28ca.com
booklearner.com
m8j9.club
mmophamthinhlegend.space
hq4a7o6zb.com
sophiadaki.online
Targets
-
-
Target
AWB# 1022355167633.exe
-
Size
598KB
-
MD5
3ac5a4a3bacfc094aabbb796c9c7d05b
-
SHA1
452d06618aeb595c3942da9bf1ad7a01ff0cda2d
-
SHA256
18e820d656b9bc40731a53a9efcd5c0866bf6d2488a0c74b7f221430003377d0
-
SHA512
0b673abb31626650698f16b94134bee5cfb7abaf53f5004ed2fd66e81d7478e259867ce6cd508c10cdc3b61da91ebd245d3ad33479f9985073bcdf754e5650d0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-