General
-
Target
866d1aeb69daac5e6e4dda938edf8d26
-
Size
430KB
-
Sample
210917-zrkvsagee4
-
MD5
866d1aeb69daac5e6e4dda938edf8d26
-
SHA1
184f3ae0508d5004a9e3fe981cbc830092d41ed7
-
SHA256
a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564
-
SHA512
e488ee1b612c683c72c9ce7d33727d1f6daa6f1bdb599b9f77fd2cf6f0b7122d650a4347bfb836bf4b5e111c92057ecfb91fd517821c32cf7b1fc246ec8bfcee
Malware Config
Extracted
xloader
2.3
b6a4
http://www.helpmovingandstorage.com/b6a4/
gr2future.com
asteroid.finance
skoba-plast.com
rnerfrfw5z3ki.net
thesmartroadtoretirement.com
avisdrummondhomes.com
banban365.net
profesyonelkampcadiri.net
royalloanhs.com
yulujy.com
xn--naqejahan-n3b.com
msalee.net
dollyvee.com
albertagamehawkersclub.com
cbspecialists.com
findingforeverrealty.com
mrtireshop.com
wadamasanari.com
growtechinfo.com
qipai039.com
Targets
-
-
Target
866d1aeb69daac5e6e4dda938edf8d26
-
Size
430KB
-
MD5
866d1aeb69daac5e6e4dda938edf8d26
-
SHA1
184f3ae0508d5004a9e3fe981cbc830092d41ed7
-
SHA256
a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564
-
SHA512
e488ee1b612c683c72c9ce7d33727d1f6daa6f1bdb599b9f77fd2cf6f0b7122d650a4347bfb836bf4b5e111c92057ecfb91fd517821c32cf7b1fc246ec8bfcee
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-