General
-
Target
e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e
-
Size
570KB
-
Sample
211029-m8ezmsdbe4
-
MD5
91679f42cd3ba051b5c7ce37d45b222c
-
SHA1
decc607894a299033ed3ede115a3bce51d21020b
-
SHA256
e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e
-
SHA512
b3dd48fc2267a50e9468e0e0be746e224618fd4aaab07e69c3f32c473831145a9fdd6a4cf87266f284bed9c9d1bf227f21f244d15242582f096dc4bf9c64855a
Malware Config
Extracted
xloader
2.5
pufi
http://www.homestechs.com/pufi/
fusiongroupgames.net
hugevari.com
rebeccagriffiths.com
trocaoferta.com
theslashapp.com
codezonesoftware.xyz
sottocommunications.com
minicreators.online
course2millions.com
hfm5n1dhkjqwpe.xyz
xlab-ub.com
silvanaribeirocake.com
thefabinteriordesign.com
mg-leadership.com
petbort.com
ndust.net
203040302.xyz
jakital.com
shophuunghia.info
rednacionaldejuecesrd.net
Targets
-
-
Target
e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e
-
Size
570KB
-
MD5
91679f42cd3ba051b5c7ce37d45b222c
-
SHA1
decc607894a299033ed3ede115a3bce51d21020b
-
SHA256
e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e
-
SHA512
b3dd48fc2267a50e9468e0e0be746e224618fd4aaab07e69c3f32c473831145a9fdd6a4cf87266f284bed9c9d1bf227f21f244d15242582f096dc4bf9c64855a
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-