General
-
Target
PAYMENT INSTRUCTIONS COPY.exe
-
Size
533KB
-
Sample
210831-2w5ayfvsax
-
MD5
51c32b446180f49c6b6537a25a191b88
-
SHA1
5a7187ad9215b34c62f96577286e01cab0436acd
-
SHA256
65a1476fde2b2c018f8eaa5e96a77156baeb6f35bd46545db8745fa4fe0c4869
-
SHA512
e622dd78122325b22e274238c025d3dfa0577b35ed1509d5fcdc3717a55484326377bc47541ac5c050183f1ab0add718e62f050d1ff1cb305f31c403749737dd
Malware Config
Extracted
xloader
2.3
n58i
http://www.mack3sleeve.com/n58i/
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
PAYMENT INSTRUCTIONS COPY.exe
-
Size
533KB
-
MD5
51c32b446180f49c6b6537a25a191b88
-
SHA1
5a7187ad9215b34c62f96577286e01cab0436acd
-
SHA256
65a1476fde2b2c018f8eaa5e96a77156baeb6f35bd46545db8745fa4fe0c4869
-
SHA512
e622dd78122325b22e274238c025d3dfa0577b35ed1509d5fcdc3717a55484326377bc47541ac5c050183f1ab0add718e62f050d1ff1cb305f31c403749737dd
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-