General
-
Target
a3aa510e_by_Libranalysis
-
Size
531KB
-
Sample
210503-vwvh36tbv2
-
MD5
a3aa510eb6f74e8dfc7a8c3bcd0fedf6
-
SHA1
286e81ec896f6746a1ca48e59dc6735c25249a37
-
SHA256
3f359e1a20563017c2f66a4e01136fbd73a9293ca1ce3df2dd880a94b9eee23e
-
SHA512
28c5048dda26762d5859488ef46cc222de632174e35d62e07b05ede307ec35309fd5636b53ba454e26386fb7033a8ae60f3cfe920b075cc1373589b14dfee2aa
Malware Config
Extracted
xloader
2.3
http://www.jqjdgw.com/ued5/
italiancosmeticbeauty.com
zhima7.com
phresheffect.com
comp-savvy.net
xjhtcaum.com
copperbrassgermkey.com
smero.financial
opticsoptimum.com
pisanosportpraxis.com
pediatricfeedrates.com
binsogleam.com
sarahseatter.com
wywatershed.com
smellyhomeshop.com
naviorchidlife.com
cunerier.com
thecornercomputers.com
brightwoodcollection.com
taxprep-repsolutions.net
phukien4u.net
Targets
-
-
Target
a3aa510e_by_Libranalysis
-
Size
531KB
-
MD5
a3aa510eb6f74e8dfc7a8c3bcd0fedf6
-
SHA1
286e81ec896f6746a1ca48e59dc6735c25249a37
-
SHA256
3f359e1a20563017c2f66a4e01136fbd73a9293ca1ce3df2dd880a94b9eee23e
-
SHA512
28c5048dda26762d5859488ef46cc222de632174e35d62e07b05ede307ec35309fd5636b53ba454e26386fb7033a8ae60f3cfe920b075cc1373589b14dfee2aa
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-