General
-
Target
POSGORSGL2110210416.exe
-
Size
477KB
-
Sample
211022-mfczksbeb9
-
MD5
37983cf849f7f7566b9572d57f0dab0f
-
SHA1
1fdf342b37fb0f6a3131d29752daf1861523e40d
-
SHA256
4c20199af53476746b9169321c057437c7341c334d61f496820876d9feb63251
-
SHA512
f8f1239ad0b2fff3826c366631dc025b31d4f0de8187be70f2ffb9363e435cdef1e9c36897f87e5457a05d6863fb81eadb5c2c031fa837a7b9b19a27337518df
Malware Config
Extracted
xloader
2.5
k8u7
http://www.ardisadr.online/k8u7/
ly3389.com
biggergrip.com
guitarbadon.net
zbjiachuang.com
maaratechnology.com
perdiemsuites.com
israel-grahamcoates.com
blackbirdfarmette.com
klhobbies.com
locdinzone.com
bestinvest-4-you.com
howtofindbantingbalance.com
kairoslabs.online
hteaz.com
banjjakdesign.com
reworkgear.com
oklahomaexcavation.com
tenloe051.xyz
blockchainpress.info
panchotrucking.com
Targets
-
-
Target
POSGORSGL2110210416.exe
-
Size
477KB
-
MD5
37983cf849f7f7566b9572d57f0dab0f
-
SHA1
1fdf342b37fb0f6a3131d29752daf1861523e40d
-
SHA256
4c20199af53476746b9169321c057437c7341c334d61f496820876d9feb63251
-
SHA512
f8f1239ad0b2fff3826c366631dc025b31d4f0de8187be70f2ffb9363e435cdef1e9c36897f87e5457a05d6863fb81eadb5c2c031fa837a7b9b19a27337518df
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-