General
-
Target
order confirmation payment copy.exe
-
Size
29KB
-
Sample
220222-r9we8sabd8
-
MD5
52b704a5b91990616f13578732a79b97
-
SHA1
fd6c83a29b70dbe8fa9dbc5971ec03f403c5061e
-
SHA256
678f04893ab76acac51db1dbfc38aa7b5bc442055e00d6f4dbc209e8d065b086
-
SHA512
416fc722b9d7d327479666bbec60fe72117cdcf7eae58265004de483641c363601b6267a4c2367256d37a2498fd44ebe6ba675c642846a378b880cbd244c0056
Malware Config
Extracted
xloader
2.5
po6r
jnhuichuangxin.com
mubashir.art
extol.design
doyyindh.xyz
milanoautoexperts.com
4thefringe.com
453511.com
sellathonautocredit.com
velgian.com
6672pk.com
wodeluzhou.com
sumiyoshiku-hizaita.xyz
imoveldeprimeira.com
dgjssp.com
endokc.com
side-clicks.com
cashndashfinancial.com
vanhemelryck.info
agamitrading.com
woofgang.xyz
Targets
-
-
Target
order confirmation payment copy.exe
-
Size
29KB
-
MD5
52b704a5b91990616f13578732a79b97
-
SHA1
fd6c83a29b70dbe8fa9dbc5971ec03f403c5061e
-
SHA256
678f04893ab76acac51db1dbfc38aa7b5bc442055e00d6f4dbc209e8d065b086
-
SHA512
416fc722b9d7d327479666bbec60fe72117cdcf7eae58265004de483641c363601b6267a4c2367256d37a2498fd44ebe6ba675c642846a378b880cbd244c0056
Score10/10-
Modifies WinLogon for persistence
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-