General
-
Target
cf3481040d52591b5a01f0b270b1db87.exe
-
Size
471KB
-
Sample
210926-r61ksaehcq
-
MD5
cf3481040d52591b5a01f0b270b1db87
-
SHA1
56b739a55c2e51b78eda3582dbb5abbcc5d787b4
-
SHA256
a0a1e9b62191e07ea98956e62287d3a9fadc0b6dbd7d6e60a755d2396b35fad6
-
SHA512
bbd5fb83897f3bbaf6f4987ad2312884233037ea850fdc8592ecebe7bf1da35da9d6f3d1c4e5351790df95c38bad60b6b14c71ad010f5d6a8e1c508860ed7be0
Malware Config
Extracted
xloader
2.3
b6a4
http://www.helpmovingandstorage.com/b6a4/
gr2future.com
asteroid.finance
skoba-plast.com
rnerfrfw5z3ki.net
thesmartroadtoretirement.com
avisdrummondhomes.com
banban365.net
profesyonelkampcadiri.net
royalloanhs.com
yulujy.com
xn--naqejahan-n3b.com
msalee.net
dollyvee.com
albertagamehawkersclub.com
cbspecialists.com
findingforeverrealty.com
mrtireshop.com
wadamasanari.com
growtechinfo.com
qipai039.com
Targets
-
-
Target
cf3481040d52591b5a01f0b270b1db87.exe
-
Size
471KB
-
MD5
cf3481040d52591b5a01f0b270b1db87
-
SHA1
56b739a55c2e51b78eda3582dbb5abbcc5d787b4
-
SHA256
a0a1e9b62191e07ea98956e62287d3a9fadc0b6dbd7d6e60a755d2396b35fad6
-
SHA512
bbd5fb83897f3bbaf6f4987ad2312884233037ea850fdc8592ecebe7bf1da35da9d6f3d1c4e5351790df95c38bad60b6b14c71ad010f5d6a8e1c508860ed7be0
Score10/10-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-