General
-
Target
e777ad1dca2df7e7c9b06832349f82e10af2259f68b0f855b10899fae8a29e7a
-
Size
256KB
-
Sample
210923-wxpjdafac3
-
MD5
5ca262d947bc9ae36f5adcc8e29d170d
-
SHA1
d2a942058386c631b7f53a055768a6ac9852d1af
-
SHA256
e777ad1dca2df7e7c9b06832349f82e10af2259f68b0f855b10899fae8a29e7a
-
SHA512
8fc417879c493879514cea3bc936c9a817568a35eccb7b7766f83a6327eb1a97ab5904af76ee7e393d6529f158f279d56410079faa8188e45bcab714bb384055
Malware Config
Extracted
xloader
2.5
m0np
http://www.devmedicalcentre.com/m0np/
gruppovimar.com
seniordatingtv.com
pinpinyouqian.website
retreatreflectreplenish.com
baby-handmade.store
econsupplies.com
helloaustinpodcast.com
europe-lodging.com
ferahanaokulu.com
thehomeinspo.com
rawhoneytnpasumo6.xyz
tyckasei.quest
scissorsandbuffer.com
jatinvestmentsmaldives.com
softandcute.store
afuturemakerspromotions.online
leonsigntech.com
havetheshortscovered.com
cvkf.email
iplyyu.com
Targets
-
-
Target
e777ad1dca2df7e7c9b06832349f82e10af2259f68b0f855b10899fae8a29e7a
-
Size
256KB
-
MD5
5ca262d947bc9ae36f5adcc8e29d170d
-
SHA1
d2a942058386c631b7f53a055768a6ac9852d1af
-
SHA256
e777ad1dca2df7e7c9b06832349f82e10af2259f68b0f855b10899fae8a29e7a
-
SHA512
8fc417879c493879514cea3bc936c9a817568a35eccb7b7766f83a6327eb1a97ab5904af76ee7e393d6529f158f279d56410079faa8188e45bcab714bb384055
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-