General
-
Target
tS1DhARF4HLvLA6.exe
-
Size
466KB
-
Sample
220203-kfc88sefbm
-
MD5
d88a53faab7f22298b69de606e38894c
-
SHA1
6472dc71a4b6d1cb508d22676656b99e2ee2c3f9
-
SHA256
e001e6df4c7f72792f62e8a6c85f7061589071eae796aff8c96343a25b9641f8
-
SHA512
92bfc7130b0e2fb93da0ec1bb044198d2f7b3aa8c00b878ed95f312e597542ad7c84f13bb13fca369a4412181b674f3640c1b4eea230c343a0ea27b157d7b2c0
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
Targets
-
-
Target
tS1DhARF4HLvLA6.exe
-
Size
466KB
-
MD5
d88a53faab7f22298b69de606e38894c
-
SHA1
6472dc71a4b6d1cb508d22676656b99e2ee2c3f9
-
SHA256
e001e6df4c7f72792f62e8a6c85f7061589071eae796aff8c96343a25b9641f8
-
SHA512
92bfc7130b0e2fb93da0ec1bb044198d2f7b3aa8c00b878ed95f312e597542ad7c84f13bb13fca369a4412181b674f3640c1b4eea230c343a0ea27b157d7b2c0
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-