General
-
Target
8c093f5b8a7931a73a9cb03245990d80
-
Size
610KB
-
Sample
240203-ly6tyaefd6
-
MD5
8c093f5b8a7931a73a9cb03245990d80
-
SHA1
e869f222e21deb3121577978fdcf40125dfe3b25
-
SHA256
69fb385f09b26bb2d7a720f53cd4491bc4406860b0889bc8ad25c3ff37f983c1
-
SHA512
eef52346619691c9797531848a395d7cd792e6b81878b1bbb3812b5400d36536b8a8e14d30751d9fb844f567c09e0491eab671a8b2290ea5f7245a2848ebc615
-
SSDEEP
12288:8vp+G1UwRWyq8MdALHr8FvRAOEft4cIq1TVfD6xndBGm:TQRVZravSBIq1TVf2JXp
Malware Config
Extracted
xloader
2.3
n8ba
thefitflect.com
anytourist.com
blggz.xyz
ascope.club
obyeboss.com
braun-mathematik.online
mtsnurulislamsby.com
jwpropertiestn.com
animalds.com
cunerier.com
sillysocklife.com
shopliyonamaaghin.net
theredcymbalsco.com
lostbikeproject.com
ryggoqlmga.club
realestatetriggers.com
luvlauricephotography.com
cheesehome.cloud
5fashionfix.net
wata-6-rwem.net
Targets
-
-
Target
P.O Contract #007676.exe
-
Size
763KB
-
MD5
f26c94499e75a2ef55d35ea0a0d2d66f
-
SHA1
cb863e15848e6665bf6e750de68acd1282e83941
-
SHA256
090bc9b1aab3f3efacd0afb55b204001290e87aaf9ddd526e298877b0eb6f416
-
SHA512
cb0060e64076197606b5d70bad4fdc49fcaf731a78e274d03df7e61c01b08b35efcc018e0d18bac31a15b170b3a9b35a5af67a269a21f742fa01534842cc619f
-
SSDEEP
12288:e5kvqoB4sZ/Bk6Nl0mN/FRk0bKB0XHEmedF6Hv4AnEzcJqLZ5yt:aXoBZZ/Bk6Nl0y/3k0bKB0XH6UHqNk
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-