General
-
Target
vbc.exe
-
Size
966KB
-
Sample
211028-hnm3ashdg8
-
MD5
9980e7e39379cbe367adf3b7443dd319
-
SHA1
1f1c0e658b23ce7be9e345bfc41edc98ddb91545
-
SHA256
9e68a0780d3c86c44563ecb3ff063bd0daa87fa141de7e1022fa285f812dacae
-
SHA512
da18abae14c407d304d66d64d96430e700ce249d5a58d66cdf6745eabd3a67e40ca9dc673613c027bf8095c589fdaff7513ed16a95815ae76eb38049ac0fc1a7
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
Targets
-
-
Target
vbc.exe
-
Size
966KB
-
MD5
9980e7e39379cbe367adf3b7443dd319
-
SHA1
1f1c0e658b23ce7be9e345bfc41edc98ddb91545
-
SHA256
9e68a0780d3c86c44563ecb3ff063bd0daa87fa141de7e1022fa285f812dacae
-
SHA512
da18abae14c407d304d66d64d96430e700ce249d5a58d66cdf6745eabd3a67e40ca9dc673613c027bf8095c589fdaff7513ed16a95815ae76eb38049ac0fc1a7
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-