General
-
Target
SecuriteInfo.com.Variant.Strictor.256388.26415.23730
-
Size
281KB
-
Sample
210304-qt1s1qqj52
-
MD5
5c904a8dc20451ed7484e73fb5cb7d58
-
SHA1
83dc2bc83549288f5b30d84170ff49bab31948b6
-
SHA256
e39cfce52a0cf7afaff83c135542b1efba4a1f04582fe3565bd5fc3b2e041f86
-
SHA512
6740e8e2fde6df2ad63fb25dab60d7a6e187ec310cc2f8e126189f4d0dff3bf102e69c60dc4ade1cb4f55d60915a9d0420ef4cbceb79b462ffd9d7e53e1248e6
Malware Config
Extracted
xloader
http://www.greensborohemorrhoidclinic.com/pkfa/
keto-easy.xyz
shizuoka-kensetsukyoka.com
biubiu.one
thepainreliefsolution.com
realternews.com
kienthucthuvi.online
bernardrobert.com
superheroesindisguise.com
albacafe.com
disocverpersonaloans.com
crimson-explicit.com
darkwidowerhumor.com
shamanredfox.com
zeno-services.com
worksmade.com
danielsenterprisesllc.com
dolebs.com
gewoongroen.com
maxtrustplumbing.com
katiebethhedges.com
Targets
-
-
Target
SecuriteInfo.com.Variant.Strictor.256388.26415.23730
-
Size
281KB
-
MD5
5c904a8dc20451ed7484e73fb5cb7d58
-
SHA1
83dc2bc83549288f5b30d84170ff49bab31948b6
-
SHA256
e39cfce52a0cf7afaff83c135542b1efba4a1f04582fe3565bd5fc3b2e041f86
-
SHA512
6740e8e2fde6df2ad63fb25dab60d7a6e187ec310cc2f8e126189f4d0dff3bf102e69c60dc4ade1cb4f55d60915a9d0420ef4cbceb79b462ffd9d7e53e1248e6
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-