General
-
Target
SN011 Price Letter79753.exe
-
Size
1.2MB
-
Sample
220125-yh5cdseaf3
-
MD5
ea148cf5de55a7490bd96798a77bb57f
-
SHA1
eb2a3c7bc48156d9f8970a01ba69793609d8777f
-
SHA256
3e26cc02d70717e07a5fad9257773db1077896d5598cc2298849ca257157c04b
-
SHA512
fa8c27b5a02769f3990a801f132cbadd8f40a7616dd6aad2c0713495ca3d4cc8979628c4dbbe53dbf13a979ae68bda9fd31b6889bcdf45364d4bbb0a016bf0eb
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
Targets
-
-
Target
SN011 Price Letter79753.exe
-
Size
1.2MB
-
MD5
ea148cf5de55a7490bd96798a77bb57f
-
SHA1
eb2a3c7bc48156d9f8970a01ba69793609d8777f
-
SHA256
3e26cc02d70717e07a5fad9257773db1077896d5598cc2298849ca257157c04b
-
SHA512
fa8c27b5a02769f3990a801f132cbadd8f40a7616dd6aad2c0713495ca3d4cc8979628c4dbbe53dbf13a979ae68bda9fd31b6889bcdf45364d4bbb0a016bf0eb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-