General
-
Target
tmp
-
Size
1.8MB
-
Sample
220610-1mhejafgfk
-
MD5
0ab42dccaffb5ec1d149601908014b50
-
SHA1
434182962a57e9cc7aa4b242d901a098402b485e
-
SHA256
4980f397fa276495555867b7628497c7cba519309051cc1cb9b43c4270103316
-
SHA512
c5501b92dc64cc59e75d8ab52c5b186e86071405dde1784b2af2057e0b7a894607410c648dd1a1f7dfbe9a699ad8e427246afe016e35ee3732e96812c6e11e4c
Malware Config
Extracted
xloader
2.6
zgtb
gabriellep.com
honghe4.xyz
anisaofrendas.com
happy-tile.com
thesulkies.com
international-ipo.com
tazeco.info
hhhzzz.xyz
vrmonster.xyz
theearthresidencia.com
sportape.xyz
elshadaibaterias.com
koredeiihibi.com
taxtaa.com
globalcityb.com
fxivcama.com
dagsmith.com
elmar-bhp.com
peakice.net
jhcdjewelry.com
Targets
-
-
Target
tmp
-
Size
1.8MB
-
MD5
0ab42dccaffb5ec1d149601908014b50
-
SHA1
434182962a57e9cc7aa4b242d901a098402b485e
-
SHA256
4980f397fa276495555867b7628497c7cba519309051cc1cb9b43c4270103316
-
SHA512
c5501b92dc64cc59e75d8ab52c5b186e86071405dde1784b2af2057e0b7a894607410c648dd1a1f7dfbe9a699ad8e427246afe016e35ee3732e96812c6e11e4c
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-