General
-
Target
2a59d2396654692dc87a81df7554b608
-
Size
433KB
-
Sample
210917-zze99sbdaj
-
MD5
2a59d2396654692dc87a81df7554b608
-
SHA1
a545b6bc8ab5afd12feb22686af50f4075fb61cd
-
SHA256
04e98a900ca361b68ebcfbad6453ddc626d93c8afb13916c18dd0e9648187566
-
SHA512
a612f5fe059baf09f6aa30c7a41c9c00d225f326d5d6a10476aa1969c2e0ce3c39986b519ff77be787a61695d71e2fc18766ea9f93509332096c0d7e613cbea8
Malware Config
Extracted
xloader
2.3
b6a4
http://www.helpmovingandstorage.com/b6a4/
gr2future.com
asteroid.finance
skoba-plast.com
rnerfrfw5z3ki.net
thesmartroadtoretirement.com
avisdrummondhomes.com
banban365.net
profesyonelkampcadiri.net
royalloanhs.com
yulujy.com
xn--naqejahan-n3b.com
msalee.net
dollyvee.com
albertagamehawkersclub.com
cbspecialists.com
findingforeverrealty.com
mrtireshop.com
wadamasanari.com
growtechinfo.com
qipai039.com
Targets
-
-
Target
2a59d2396654692dc87a81df7554b608
-
Size
433KB
-
MD5
2a59d2396654692dc87a81df7554b608
-
SHA1
a545b6bc8ab5afd12feb22686af50f4075fb61cd
-
SHA256
04e98a900ca361b68ebcfbad6453ddc626d93c8afb13916c18dd0e9648187566
-
SHA512
a612f5fe059baf09f6aa30c7a41c9c00d225f326d5d6a10476aa1969c2e0ce3c39986b519ff77be787a61695d71e2fc18766ea9f93509332096c0d7e613cbea8
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-