General
-
Target
vbc.exezadzkwao
-
Size
557KB
-
Sample
220611-vnwqnadcc3
-
MD5
bfc1df301dd7522c221795076cf65929
-
SHA1
5eff27087a49d17373c90834cd3b831c527ef568
-
SHA256
7dd0edd3378d0ca5ac63530a7bcfbb23584b5ea8c660fd71393f0bf03506c270
-
SHA512
df7b66979905e2cd09d34f1ade28646109e1a2a5c21c2a990ead50c776aa60792320d07a1556a44e1926dcaa2fac6a5ad3f708856f30c0d1cf0553bfad83476b
Malware Config
Extracted
xloader
2.6
zgtb
gabriellep.com
honghe4.xyz
anisaofrendas.com
happy-tile.com
thesulkies.com
international-ipo.com
tazeco.info
hhhzzz.xyz
vrmonster.xyz
theearthresidencia.com
sportape.xyz
elshadaibaterias.com
koredeiihibi.com
taxtaa.com
globalcityb.com
fxivcama.com
dagsmith.com
elmar-bhp.com
peakice.net
jhcdjewelry.com
Targets
-
-
Target
vbc.exezadzkwao
-
Size
557KB
-
MD5
bfc1df301dd7522c221795076cf65929
-
SHA1
5eff27087a49d17373c90834cd3b831c527ef568
-
SHA256
7dd0edd3378d0ca5ac63530a7bcfbb23584b5ea8c660fd71393f0bf03506c270
-
SHA512
df7b66979905e2cd09d34f1ade28646109e1a2a5c21c2a990ead50c776aa60792320d07a1556a44e1926dcaa2fac6a5ad3f708856f30c0d1cf0553bfad83476b
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-