General
-
Target
b4c38f5773a411d2c89745868a429166
-
Size
245KB
-
Sample
220420-k41dnsech5
-
MD5
b4c38f5773a411d2c89745868a429166
-
SHA1
656d352861e823904d11d8a026dfe2d983602d93
-
SHA256
74da3d3dfb3984d65eaa0e926f3e91c46d2e3672cb67bca6153f7c4a1b2d2bba
-
SHA512
657731328e621e03d961281a5dd6bcc06591bdd0a4baf8917cc5e6b30a7a57c73fa091ee9e3b98ad4f29c88d2de1737fdac004850c9be6db22701e87cae1ca0d
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
Targets
-
-
Target
SKM_1504322RS.exe
-
Size
192KB
-
MD5
d382db9d903f52d9f2f7eb2c1039b824
-
SHA1
c2e97ed52203259715f51ee9844176e18ea2cbbe
-
SHA256
59552104d4bb2bcc6518dab735dac7dbb731a988dda8b82d39fa10911e7b8ee3
-
SHA512
93711c47076a3c90d63ecf79b5d17a4a0f188cc7fd790f9af0740ee0907876fdbbc33da4e84a0f1b85050e9a00b0f05a592a78c0822b8251d3011f50427e56b3
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-