General
-
Target
1ddab1d12897b353069240b2c32f33a0592dbee2d6570afd3e1e6f159b23ffa2
-
Size
862KB
-
Sample
220130-tj1y5sefa9
-
MD5
a26ae8f21a272f7c27568e1235f55c23
-
SHA1
37e656cfda5191424386d0f49e36fad25356cfe5
-
SHA256
1ddab1d12897b353069240b2c32f33a0592dbee2d6570afd3e1e6f159b23ffa2
-
SHA512
a13f53a49434e5068d1ab2cf214cc4550a30d91ab27212f9d0f5a020bfd57f8a423cc0177f503f759059252ca57c33a4f7bf38a730af8db78ee9a102e553c2c1
Malware Config
Extracted
xloader
2.3
kio8
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
Targets
-
-
Target
Inquiry 21.1.2021.exe
-
Size
800KB
-
MD5
059c56876497cfe76c5fd67bb83fd8a6
-
SHA1
d0c8bcffd9a9393e02afa12d0d1d6da3f5ae5426
-
SHA256
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4
-
SHA512
06ce3b9bb8d3c80efae131ec7c5c17168f2ca78b177e94c79b1ef3b36d8b8ab87c1da86468419017aaf34cdcf45e71a6666715014a5d3a5811194939367dfcd5
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-