General
-
Target
cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
-
Size
256KB
-
Sample
210928-jf7bmsbae5
-
MD5
f2afb3a86d4b205705b0ec883e969f39
-
SHA1
edb2e066091b33f278e45d77c2c5fa0d0f2f360d
-
SHA256
cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
-
SHA512
0a7e09bbdfb44b66916646bfb3c464911fcbc79eb521354406c69dfb93cd0c6ea21b0558c178cb7cfb45071589824cbebcc899ffa05c3cef8be28006dc4f372f
Malware Config
Extracted
xloader
2.5
m0np
http://www.devmedicalcentre.com/m0np/
gruppovimar.com
seniordatingtv.com
pinpinyouqian.website
retreatreflectreplenish.com
baby-handmade.store
econsupplies.com
helloaustinpodcast.com
europe-lodging.com
ferahanaokulu.com
thehomeinspo.com
rawhoneytnpasumo6.xyz
tyckasei.quest
scissorsandbuffer.com
jatinvestmentsmaldives.com
softandcute.store
afuturemakerspromotions.online
leonsigntech.com
havetheshortscovered.com
cvkf.email
iplyyu.com
Targets
-
-
Target
cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
-
Size
256KB
-
MD5
f2afb3a86d4b205705b0ec883e969f39
-
SHA1
edb2e066091b33f278e45d77c2c5fa0d0f2f360d
-
SHA256
cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
-
SHA512
0a7e09bbdfb44b66916646bfb3c464911fcbc79eb521354406c69dfb93cd0c6ea21b0558c178cb7cfb45071589824cbebcc899ffa05c3cef8be28006dc4f372f
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-