General
-
Target
SecuriteInfo.com.Variant.MSILHeracles.38917.23355.26869
-
Size
765KB
-
Sample
220602-rxexqageh2
-
MD5
2bde08e441932b23ece2bddbfdaf75c4
-
SHA1
668053b0d1207c46be5d7a6403544df5fb8a6c85
-
SHA256
35309e1fa49bbe9962da705e5318012b8c8b4b74d2b047a6cb8d3e7d8012ff5e
-
SHA512
6b9b3f3c7b5a89ffa6a9e1c70104e327bf45dbb21520d0d25a574bccb84adea0680f8d317bbc1859bf2d31fa15924e936149b67468df5040ff85364a7f746213
Malware Config
Extracted
xloader
2.6
a8hq
veteransductcleaning.com
beajtjunkies.com
houseofascofi.com
scottsdalemediator.com
atelyadesign.com
profitcase.pro
imtokenio.club
qinglingpai.com
bigsmile-meal.net
daytonlivestream.com
aspiradores10.online
ytybs120.com
hdatelier.com
bearpierce.com
yeson28ca.com
booklearner.com
m8j9.club
mmophamthinhlegend.space
hq4a7o6zb.com
sophiadaki.online
Targets
-
-
Target
SecuriteInfo.com.Variant.MSILHeracles.38917.23355.26869
-
Size
765KB
-
MD5
2bde08e441932b23ece2bddbfdaf75c4
-
SHA1
668053b0d1207c46be5d7a6403544df5fb8a6c85
-
SHA256
35309e1fa49bbe9962da705e5318012b8c8b4b74d2b047a6cb8d3e7d8012ff5e
-
SHA512
6b9b3f3c7b5a89ffa6a9e1c70104e327bf45dbb21520d0d25a574bccb84adea0680f8d317bbc1859bf2d31fa15924e936149b67468df5040ff85364a7f746213
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-