General
-
Target
5104346496bc62f40a74fc3dcefb28638d598778d467b3e1a693e8da3ec1105e
-
Size
406KB
-
Sample
220131-v8m91sbae5
-
MD5
472e0e3bec8559dab9cea3e10d55cc3d
-
SHA1
f0cc62a1b0aa2005d4c70eb23c7ae8ec42131f9d
-
SHA256
5104346496bc62f40a74fc3dcefb28638d598778d467b3e1a693e8da3ec1105e
-
SHA512
36ad8624d9a995eeadd4e32d199fb2f0bdf163c0227a322d21604549d6e326fffdad1ea7fb53164080b173e6dfd224643d4567883223418632840d44032f291b
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
Shipment Advise 20035506.exe
-
Size
684KB
-
MD5
73a3ea879432d4dde94f127853025919
-
SHA1
354a543f9ec40cbf8dc62847da905b0b22ad804f
-
SHA256
112816e3c681b862208badf3069a7108fb356effaeab80d0235b613e653d9da5
-
SHA512
67e2f54e370d7d9e21a366cf6082ae736a564a3c419a3883cc8671cea003839a5f0f8bb7def3ee6297d15efbbd8556b04d50569e6a9a954b6694e63e11408fcb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-