General
-
Target
c3732a4c293740632956474cb15e9f25f77cd96b6a40366c137f29b5df1d819e
-
Size
304KB
-
Sample
211117-13xt6aebb6
-
MD5
e0c09b7302a96d737a7573a7938ea389
-
SHA1
2d064fc357be869f8bf7d57f099b5edd1aeaa0a8
-
SHA256
c3732a4c293740632956474cb15e9f25f77cd96b6a40366c137f29b5df1d819e
-
SHA512
830c1b59658a9f744f59e39281a0102cbfef538b03f93154b1310dfab017768095d0aec2688ee464f87cff41ca9e13400c3cefde681e1d171ad2c9525abb592e
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
Targets
-
-
Target
c3732a4c293740632956474cb15e9f25f77cd96b6a40366c137f29b5df1d819e
-
Size
304KB
-
MD5
e0c09b7302a96d737a7573a7938ea389
-
SHA1
2d064fc357be869f8bf7d57f099b5edd1aeaa0a8
-
SHA256
c3732a4c293740632956474cb15e9f25f77cd96b6a40366c137f29b5df1d819e
-
SHA512
830c1b59658a9f744f59e39281a0102cbfef538b03f93154b1310dfab017768095d0aec2688ee464f87cff41ca9e13400c3cefde681e1d171ad2c9525abb592e
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-