General
-
Target
New Order 20835103.r00
-
Size
396KB
-
Sample
210915-3pd61abfe6
-
MD5
3030afdbe48f7ed021cd735bf925636b
-
SHA1
f78008a829d0636346dda955851cfe2db75433fe
-
SHA256
17c043ba55fafd013b55f51874cb0d620669ca68e9a0ad2f78dbea8fafffddc6
-
SHA512
2087e3553bbb9bd92b599ff0385a841dd3739409912382f999540ee8d8010764da7b559d6eddd8cee7227881267e3b0f1321b70b5bcd65f1452f4cb3e05f89b7
Malware Config
Extracted
xloader
2.4
t75f
http://www.438451.com/t75f/
ice-lemon.pro
ar3spro.cloud
9055837.com
fucksociety.net
prettyofficialx.com
mfxw.xyz
relationshipquiz.info
customia.xyz
juanayjuan.com
zidiankj.com
facture-booking.com
secondmining.store
aboutyou.club
gongxichen.com
laurabraincreative.com
pierrot-bros.com
saintpaulaccountingservices.com
dom-maya.com
garderobamarzen.net
la-salamandre-assurances.com
Targets
-
-
Target
pay.exe
-
Size
493KB
-
MD5
d08e51116e789fa67fd4d535ad4f399b
-
SHA1
1d7d28fb75910f580d75167c0b30ebadd79fe8ca
-
SHA256
7deecd8502e99ced6aec8588840f7e972a3b030c19e0e88ef94ec3a9d2ababc9
-
SHA512
6a576a4765cd48138989742cad201abc09941290d70459b13e9dbe3680fe6b291a4a422fbc7dfc4c26e0b554794015194f78c6d2e2082053ba9c1a2a9313bfa1
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-