General
-
Target
19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
-
Size
254KB
-
Sample
211021-1akdcsbfgk
-
MD5
73fe142254abec3aeaef375f0564d40a
-
SHA1
8529d972dd89f69eb2dc2a3ba9207e67626de9b9
-
SHA256
19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
-
SHA512
848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e
Malware Config
Extracted
xloader
2.5
kqna
http://www.surfsolutions.info/kqna/
achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
Targets
-
-
Target
19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
-
Size
254KB
-
MD5
73fe142254abec3aeaef375f0564d40a
-
SHA1
8529d972dd89f69eb2dc2a3ba9207e67626de9b9
-
SHA256
19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
-
SHA512
848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-