General
-
Target
PO-003785GMHN.rar
-
Size
460KB
-
Sample
210928-gn6zqsafg3
-
MD5
e9709c19ecec4544231414a6e41e549b
-
SHA1
f64e2f97bf9aa4dd79e45ba3afd629803b868abc
-
SHA256
cee79dcd06a8354c8463e908688747f902eaa09bb2af10c446b622126d51c530
-
SHA512
d159b261e78a9c4dcf35cb502e3b3a72d127a51b4f905ce6ca0165cecc48bf0ae9fb1e9c69fed29546de4c953dc3049c5e7bb37490639f3167afc5f5fa6920f7
Malware Config
Extracted
xloader
2.5
8iwd
http://www.serpascarnes.com/8iwd/
openhousedigitale.com
helpindia.store
josiahspicer.com
wydancer.com
athinatoday.com
asiapartnerspoint.com
freemakechefsrecipes.com
metrolistingsservices.com
assarytagged.quest
ververevival.com
cjdue.com
iqmetaverse.com
sh-spgdk.com
spacecitybeauty.com
phasmatoidea.com
yz1866.com
tenlog009.xyz
gameprizes.xyz
415know.com
virus-jestock.com
Targets
-
-
Target
PO-003785GMHN.exe
-
Size
985KB
-
MD5
4577c41fc896a87df4513f13d29ee65a
-
SHA1
38e76942a779e8b04cdf763cf993ceda76d049f2
-
SHA256
144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
-
SHA512
dbd15ae87202593f80daf6563bd7ef8bb9be154c7c1995ca6c127c7bfa8e8fb1eb5d9c075d887ef8a893fa64ddb72402e11da3c7f57aeda276ee4fc3c50f21af
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Adds Run key to start application
-