General
-
Target
aT8aer3ybNvYpl3.exe
-
Size
803KB
-
Sample
210920-ytpfbafce5
-
MD5
1eaf8232051d48b6207937c971965e2d
-
SHA1
0e1edb9297f0b7db297be69d4aee0c3a38eb7b84
-
SHA256
0693c816986f73899e351e1989103e680c336f401cca1d14f5bce3b5865cfee6
-
SHA512
c4d32524b6448e26a4aaa6224e6e55adbd040d2b1389cf5702386e7bf8a965232f8aa2b73d43b3da5424487e008fda05f003e280a233d6b1785374f7cc987d75
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
Targets
-
-
Target
aT8aer3ybNvYpl3.exe
-
Size
803KB
-
MD5
1eaf8232051d48b6207937c971965e2d
-
SHA1
0e1edb9297f0b7db297be69d4aee0c3a38eb7b84
-
SHA256
0693c816986f73899e351e1989103e680c336f401cca1d14f5bce3b5865cfee6
-
SHA512
c4d32524b6448e26a4aaa6224e6e55adbd040d2b1389cf5702386e7bf8a965232f8aa2b73d43b3da5424487e008fda05f003e280a233d6b1785374f7cc987d75
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-