General
-
Target
ece961a4e49709bd6483ef6fd35722e8efdce2e848ad2388fa993eb8cb9019b4
-
Size
879KB
-
Sample
211117-fkn43shda2
-
MD5
d75df7f23c5229c75949209b99316ae4
-
SHA1
5cfb1a9b674529e12f2248e3f92405f3b66f3f0e
-
SHA256
ece961a4e49709bd6483ef6fd35722e8efdce2e848ad2388fa993eb8cb9019b4
-
SHA512
38be450779a0424bfbebbe042c3f98209aa4808aaca6ebc48965a96fb13d781e5ea78ab6d1719b29f0622a65aec761ca41b02af8bc8739f6240dc3b74a258dd4
Malware Config
Extracted
xloader
2.5
ht08
http://www.septemberstockevent200.com/ht08/
joye.club
istanbulemlakgalerisi.online
annikadaniel.love
oooci.com
curebase-test.com
swisstradecenter.com
hacticum.com
centercodebase.com
recbi56ni.com
mmj0115.xyz
sharpstead.com
sprklbeauty.com
progettogenesi.cloud
dolinum.com
amaroqadvisors.com
traininig.com
leewaysvcs.com
nashhomesearch.com
joy1263.com
serkanyamac.com
Targets
-
-
Target
ece961a4e49709bd6483ef6fd35722e8efdce2e848ad2388fa993eb8cb9019b4
-
Size
879KB
-
MD5
d75df7f23c5229c75949209b99316ae4
-
SHA1
5cfb1a9b674529e12f2248e3f92405f3b66f3f0e
-
SHA256
ece961a4e49709bd6483ef6fd35722e8efdce2e848ad2388fa993eb8cb9019b4
-
SHA512
38be450779a0424bfbebbe042c3f98209aa4808aaca6ebc48965a96fb13d781e5ea78ab6d1719b29f0622a65aec761ca41b02af8bc8739f6240dc3b74a258dd4
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-