General
-
Target
Payment_invoice.exe
-
Size
886KB
-
Sample
210722-hp2fhj7xax
-
MD5
6633c63dfbe9126b630fab6db6ef845f
-
SHA1
9649c26901a9d0b28393f979df51203bc90ab861
-
SHA256
86b93054415c6e4c21fd68ad13fcdbbd9a300c275dfe4f768ffd2fdf42db4694
-
SHA512
bae5712b4f42ef292617edd44e970dece521cdcc38bf79ebcb7332a2e0a1591f64a71097f49c51557211b2f78a245e46953f4eeb80ffff9a890c191f671f062e
Malware Config
Extracted
xloader
2.3
http://www.illoftapartments.com/uecu/
ishtarhotel.com
woodstrends.icu
jalenowens.com
manno.expert
ssg1asia.com
telepathylaw.com
quickoprintnv.com
abrosnm3.com
lumberjackcatering.com
beachujamaica.com
thomasjeffersonbyrd.com
starryfinds.com
shelavish2.com
royalglamempirellc.com
deixandomeuemprego.com
alexgoestech.xyz
opticamn.com
fermanchevybrandon.com
milbodegas.info
adunarsrl.com
Targets
-
-
Target
Payment_invoice.exe
-
Size
886KB
-
MD5
6633c63dfbe9126b630fab6db6ef845f
-
SHA1
9649c26901a9d0b28393f979df51203bc90ab861
-
SHA256
86b93054415c6e4c21fd68ad13fcdbbd9a300c275dfe4f768ffd2fdf42db4694
-
SHA512
bae5712b4f42ef292617edd44e970dece521cdcc38bf79ebcb7332a2e0a1591f64a71097f49c51557211b2f78a245e46953f4eeb80ffff9a890c191f671f062e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-