General
-
Target
SecuriteInfo.com.Trojan.GenericKDZ.74423.1321.32346
-
Size
331KB
-
Sample
210420-2z2blqrpg2
-
MD5
a5c974a5617823b3de03e26b469ad47d
-
SHA1
197b391fcd3b7b41e07f819535691405194fe2a4
-
SHA256
a3ae710cb1edbfd1f9cc33ab53ffddd288646a040118b2bc252cc6ac070a8308
-
SHA512
b660fab41fadc6497216ef3f0e3750f153f5f59f5dba0e30c60afba731b368b65d18576f1f5ca8ef10b52df97423f9addf1d1f9fd296d779c0d8d51e968ae4d1
Malware Config
Extracted
xloader
2.3
http://www.nyclgbxyi.icu/u6nq/
lamailefr.com
creativesword.com
mpconnextions.com
tureture-diary.net
ateamtotalcare.com
ihealthsauna.com
contex33.xyz
hotege.club
candiceco.com
southerntwistent.com
foivgohl.com
azetheelynn.art
galsmith.com
alphaquantumfunds.site
mursiony.club
ajobfit.com
resourceunits.com
metropolitanez.net
shaohuizq.com
tedbagsstore.com
Targets
-
-
Target
SecuriteInfo.com.Trojan.GenericKDZ.74423.1321.32346
-
Size
331KB
-
MD5
a5c974a5617823b3de03e26b469ad47d
-
SHA1
197b391fcd3b7b41e07f819535691405194fe2a4
-
SHA256
a3ae710cb1edbfd1f9cc33ab53ffddd288646a040118b2bc252cc6ac070a8308
-
SHA512
b660fab41fadc6497216ef3f0e3750f153f5f59f5dba0e30c60afba731b368b65d18576f1f5ca8ef10b52df97423f9addf1d1f9fd296d779c0d8d51e968ae4d1
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-