General
-
Target
ConsoleApp19-1.bin
-
Size
297KB
-
Sample
211111-nawp6sbbe4
-
MD5
ff0346aa38686d926213531b0aaa0483
-
SHA1
0e4954ca4aa00ed14e2bc86ed958a167acf45c95
-
SHA256
9ad6256ea0f91732feb8382528a871eba43cd7e94c475bfb90b7711e9b4931ab
-
SHA512
33404633d8ce92a5aa49b6393b9ccd7bbd818f51c4b24d82cc23687d4412096d16fdf0def7982f53df66b8f287e44f25967cd4134352d67744fcb1a0f3dc2cb8
Malware Config
Extracted
xloader
2.5
pufi
http://www.homestechs.com/pufi/
fusiongroupgames.net
hugevari.com
rebeccagriffiths.com
trocaoferta.com
theslashapp.com
codezonesoftware.xyz
sottocommunications.com
minicreators.online
course2millions.com
hfm5n1dhkjqwpe.xyz
xlab-ub.com
silvanaribeirocake.com
thefabinteriordesign.com
mg-leadership.com
petbort.com
ndust.net
203040302.xyz
jakital.com
shophuunghia.info
rednacionaldejuecesrd.net
Targets
-
-
Target
ConsoleApp19-1.bin
-
Size
297KB
-
MD5
ff0346aa38686d926213531b0aaa0483
-
SHA1
0e4954ca4aa00ed14e2bc86ed958a167acf45c95
-
SHA256
9ad6256ea0f91732feb8382528a871eba43cd7e94c475bfb90b7711e9b4931ab
-
SHA512
33404633d8ce92a5aa49b6393b9ccd7bbd818f51c4b24d82cc23687d4412096d16fdf0def7982f53df66b8f287e44f25967cd4134352d67744fcb1a0f3dc2cb8
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-