General
-
Target
e2827700e9676ad0d4b734d5f4a221b3
-
Size
685KB
-
Sample
211022-sfljlsbge7
-
MD5
e2827700e9676ad0d4b734d5f4a221b3
-
SHA1
2997b29050c7e44072f886705cbd4be6a3edda97
-
SHA256
a8ea6b5e7721a2d508d362f9e75fc38fe3b845375c358829ef0604cc2345aa13
-
SHA512
d16e61c88eb9c32fd1c74b4893fb08092bbca5ae17f4275eecd7bc2352dad0904e4dc603be4747e0a9460507187e2bad78a51ffc055cb9b2b7baebff550abbd2
Malware Config
Extracted
xloader
2.5
k8u7
http://www.ardisadr.online/k8u7/
ly3389.com
biggergrip.com
guitarbadon.net
zbjiachuang.com
maaratechnology.com
perdiemsuites.com
israel-grahamcoates.com
blackbirdfarmette.com
klhobbies.com
locdinzone.com
bestinvest-4-you.com
howtofindbantingbalance.com
kairoslabs.online
hteaz.com
banjjakdesign.com
reworkgear.com
oklahomaexcavation.com
tenloe051.xyz
blockchainpress.info
panchotrucking.com
Targets
-
-
Target
e2827700e9676ad0d4b734d5f4a221b3
-
Size
685KB
-
MD5
e2827700e9676ad0d4b734d5f4a221b3
-
SHA1
2997b29050c7e44072f886705cbd4be6a3edda97
-
SHA256
a8ea6b5e7721a2d508d362f9e75fc38fe3b845375c358829ef0604cc2345aa13
-
SHA512
d16e61c88eb9c32fd1c74b4893fb08092bbca5ae17f4275eecd7bc2352dad0904e4dc603be4747e0a9460507187e2bad78a51ffc055cb9b2b7baebff550abbd2
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-