General
-
Target
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
-
Size
290KB
-
Sample
211110-wjky2ahhe2
-
MD5
521339ae9fa89c3af1b50456781272a8
-
SHA1
3e79f4911ff9187b0300dcca9d0dcc6108afaecb
-
SHA256
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
-
SHA512
54a1f89f2711ed2aa8d10e0a57bf287b84ca02be78e42960bf4defbb8bbfb6707bc58052a433a199f05121b8e155105209c409afe9e81547c7e573f39acddff3
Malware Config
Extracted
xloader
2.5
pufi
http://www.homestechs.com/pufi/
fusiongroupgames.net
hugevari.com
rebeccagriffiths.com
trocaoferta.com
theslashapp.com
codezonesoftware.xyz
sottocommunications.com
minicreators.online
course2millions.com
hfm5n1dhkjqwpe.xyz
xlab-ub.com
silvanaribeirocake.com
thefabinteriordesign.com
mg-leadership.com
petbort.com
ndust.net
203040302.xyz
jakital.com
shophuunghia.info
rednacionaldejuecesrd.net
Targets
-
-
Target
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
-
Size
290KB
-
MD5
521339ae9fa89c3af1b50456781272a8
-
SHA1
3e79f4911ff9187b0300dcca9d0dcc6108afaecb
-
SHA256
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
-
SHA512
54a1f89f2711ed2aa8d10e0a57bf287b84ca02be78e42960bf4defbb8bbfb6707bc58052a433a199f05121b8e155105209c409afe9e81547c7e573f39acddff3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-