General
-
Target
B7hG4D8Jqvkw77U.exe
-
Size
701KB
-
Sample
210909-3wp7vaghg6
-
MD5
59ddaf036f92887a34441505f84d8cc8
-
SHA1
85745689e2f889b94b37379393a97a7a87dfec8b
-
SHA256
34f75f8458b1f58bdb1e8ff1a46270f98c6d246d213413cd0c4a7708e15e82c9
-
SHA512
336d392772f6d65f203f246c462673c92a293b91f4afc226c9613a80444004f69ef18572854e5755b22602efebfe6a0ad167a12a97ba00922a0fc8aaa3d7b0e5
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
Targets
-
-
Target
B7hG4D8Jqvkw77U.exe
-
Size
701KB
-
MD5
59ddaf036f92887a34441505f84d8cc8
-
SHA1
85745689e2f889b94b37379393a97a7a87dfec8b
-
SHA256
34f75f8458b1f58bdb1e8ff1a46270f98c6d246d213413cd0c4a7708e15e82c9
-
SHA512
336d392772f6d65f203f246c462673c92a293b91f4afc226c9613a80444004f69ef18572854e5755b22602efebfe6a0ad167a12a97ba00922a0fc8aaa3d7b0e5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-