General
-
Target
40674110ecc6a402569f906e115d3d8b.exe
-
Size
15KB
-
Sample
220304-h6n3bafecp
-
MD5
40674110ecc6a402569f906e115d3d8b
-
SHA1
6771637dd6d3d89a9fd630f7b179d379b558bf77
-
SHA256
c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557
-
SHA512
809c144a8418c0cd06ff365f51602000b2cc836d9cf49e8c9b2c394e1de9a61941cf461beec169d6837a2b29ad7aa70a936ddc59b9c1ea99e24efeae76bab018
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
Targets
-
-
Target
40674110ecc6a402569f906e115d3d8b.exe
-
Size
15KB
-
MD5
40674110ecc6a402569f906e115d3d8b
-
SHA1
6771637dd6d3d89a9fd630f7b179d379b558bf77
-
SHA256
c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557
-
SHA512
809c144a8418c0cd06ff365f51602000b2cc836d9cf49e8c9b2c394e1de9a61941cf461beec169d6837a2b29ad7aa70a936ddc59b9c1ea99e24efeae76bab018
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Downloads MZ/PE file
-
Suspicious use of SetThreadContext
-