General
-
Target
0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd
-
Size
249KB
-
Sample
211019-g2egmsgbhl
-
MD5
b8278e92923b15789354b41cc89b638f
-
SHA1
9e4dc8a87d8ca82c8220ff05abed303e899b3822
-
SHA256
0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd
-
SHA512
6c948ef9eb3781aca24ab411d4bba93fff5ec052baa622b9fcb026edd3ead6098b5e371381cc398c91fae92ae9ac308450e08515a47d3b2b2ded682c51715418
Malware Config
Extracted
xloader
2.5
noha
http://www.mglracing.com/noha/
iphone13promax.support
trailer-racks.xyz
overseaspoolservice.com
r2d2u.com
dawajeju.com
nextgenproxyvote.com
xn--vhqp8mm8dbtz.group
commonsenserisk.com
cmcqgxtyd.com
data2form.com
bois-applique.com
originallollipop.com
lj0008lj.net
spfldvaccineday.info
phalcosnusa.com
llcmastermachine.com
onlyforu14.rest
bestmarketingautomations.com
officialswitchmusic.com
thepretenseofjustice.com
Targets
-
-
Target
0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd
-
Size
249KB
-
MD5
b8278e92923b15789354b41cc89b638f
-
SHA1
9e4dc8a87d8ca82c8220ff05abed303e899b3822
-
SHA256
0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd
-
SHA512
6c948ef9eb3781aca24ab411d4bba93fff5ec052baa622b9fcb026edd3ead6098b5e371381cc398c91fae92ae9ac308450e08515a47d3b2b2ded682c51715418
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-