General
-
Target
5447b15a3f80096e9bd3fdbdbc03a82f
-
Size
1.0MB
-
Sample
220804-1bsfcsbbc7
-
MD5
5447b15a3f80096e9bd3fdbdbc03a82f
-
SHA1
b60664b0ce0185e24f8ae1c19082182d9a27e7f1
-
SHA256
d08cd1ead949f279f023eaf1618ff2195f12d0d336e2da695855ff8e43071df5
-
SHA512
418a2e4b326fc89b7ad577d53e2806f6b26c2af052086ea6c5f17601e53e872ac0243745c0b0ffecb4804568afb06f3b5d71966d0336f7068c0aaa85a9af69e7
Malware Config
Extracted
xloader
2.6
vweq
liharyo.store
irts-byscioteq.com
364665.com
doorknob.xyz
flowerempire.online
wintec-beratung.com
samadidentalclinics.com
rachelallencounseling.com
luprs.online
dcyshopingit.website
dadagaga.group
modayunpocomas.com
yishanone.com
zaqqerr.com
mojavestack.com
investors-field.com
villanewinsxr.com
sdlanyutu.com
inno-link.tech
shuangyingmaoyi.com
Targets
-
-
Target
????_RFQ392.exe
-
Size
1.5MB
-
MD5
188babd6d305e4438404b519473d9567
-
SHA1
9bf5dc357f2524de68c73f0bf5cf3259b026eb7a
-
SHA256
0809edb5bbdded6dda34ff69292f009fe64e8fa20e3abbf1a6f1896f4d6f8aec
-
SHA512
cec16c57f791bb5d28e2401b052d18531f21aaf80f36689cd96689fd4bc832051ea981f9912f1af4d65f2d7392025a15569cde6daa787b662fce8ae163618969
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-