General
-
Target
8893fe00e5bfd3794018c17254c26375.exe
-
Size
820KB
-
Sample
220209-tqthmsbagn
-
MD5
8893fe00e5bfd3794018c17254c26375
-
SHA1
2921a9af9980c6e63549aa23f396e61c8aff916a
-
SHA256
cba2f725d2b6b4212d2e8ba58b7e26e59e3276065d1f58fd11eeeaf0dfb15aeb
-
SHA512
9a9c58191ff5ec3dac4d5e2d3f7acdfdb67d180705cf59350eab2f01b2b553ce9627e66da198b2122eb9ff3e8d7d9208ec66c2e398e6a55feda479b22919e267
Malware Config
Extracted
xloader
2.5
dpzz
roadstown.com
idfaltd.com
infotechsearchgroup.com
elcuentodelaprincesa.com
youkutiyu88.com
wildparkresort.com
iss-sa.com
jmglaser.com
criticalthinking.store
cabinetsossa.com
satseconomy.com
newendtech.com
gran-piel.com
accoya.net
timothyschmallrealt.com
valentikaeventos.com
majestineprojector.com
love-austria.com
hermetikyogusmalikombi.com
karasevda-jor.com
Targets
-
-
Target
8893fe00e5bfd3794018c17254c26375.exe
-
Size
820KB
-
MD5
8893fe00e5bfd3794018c17254c26375
-
SHA1
2921a9af9980c6e63549aa23f396e61c8aff916a
-
SHA256
cba2f725d2b6b4212d2e8ba58b7e26e59e3276065d1f58fd11eeeaf0dfb15aeb
-
SHA512
9a9c58191ff5ec3dac4d5e2d3f7acdfdb67d180705cf59350eab2f01b2b553ce9627e66da198b2122eb9ff3e8d7d9208ec66c2e398e6a55feda479b22919e267
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-