General
-
Target
1898f81a98377b5461ebcdc775708f9f27e3f721f3f822383d58271f8c36940e
-
Size
256KB
-
Sample
210920-ml3r7adga6
-
MD5
f8e9ce19f4c0d0896203a7caf2fc5cd0
-
SHA1
b009e148764404c040683318e2a451ef61fd949d
-
SHA256
1898f81a98377b5461ebcdc775708f9f27e3f721f3f822383d58271f8c36940e
-
SHA512
2b071b94827972e65f0ca010b22d9d5a3b5fb35a77d97bd968aae2aad4b73f072e2ece013b877f441df675fd234795266979d9a45acd29d4141e7b25f011d5b1
Malware Config
Extracted
xloader
2.5
m0np
http://www.devmedicalcentre.com/m0np/
gruppovimar.com
seniordatingtv.com
pinpinyouqian.website
retreatreflectreplenish.com
baby-handmade.store
econsupplies.com
helloaustinpodcast.com
europe-lodging.com
ferahanaokulu.com
thehomeinspo.com
rawhoneytnpasumo6.xyz
tyckasei.quest
scissorsandbuffer.com
jatinvestmentsmaldives.com
softandcute.store
afuturemakerspromotions.online
leonsigntech.com
havetheshortscovered.com
cvkf.email
iplyyu.com
Targets
-
-
Target
1898f81a98377b5461ebcdc775708f9f27e3f721f3f822383d58271f8c36940e
-
Size
256KB
-
MD5
f8e9ce19f4c0d0896203a7caf2fc5cd0
-
SHA1
b009e148764404c040683318e2a451ef61fd949d
-
SHA256
1898f81a98377b5461ebcdc775708f9f27e3f721f3f822383d58271f8c36940e
-
SHA512
2b071b94827972e65f0ca010b22d9d5a3b5fb35a77d97bd968aae2aad4b73f072e2ece013b877f441df675fd234795266979d9a45acd29d4141e7b25f011d5b1
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-