General
-
Target
25e4adba5d0ef98cb4f2a30b964254c5189d687d8af747533fe380907f36173b
-
Size
525KB
-
Sample
211124-jw54hsfdc8
-
MD5
2047db38e2d0017545a2842b5266b9ad
-
SHA1
298b391c34e934bda7808a54e601b6c64dfba05c
-
SHA256
25e4adba5d0ef98cb4f2a30b964254c5189d687d8af747533fe380907f36173b
-
SHA512
42301389bb71daf31c8ac50640eee94a6e7ecef85e07e7ff3f78d3a6e69eb68207ffadb50cc417bf724ce124c6c21e7eb16f1baaf9fb05c1fbabae07d1481fd7
Malware Config
Extracted
xloader
2.5
u0n0
http://www.52xjg3.xyz/u0n0/
learnwithvr.net
minismi2.com
slimfitbottle.com
gzartisan.com
fullfamilyclub.com
adaptationstudios.com
domynt.com
aboydnfuid.com
dirtroaddesigns.net
timhortons-ca.xyz
gladiator-111.com
breakingza.com
njjbds.com
keithrgordon.com
litestore365.host
unichromegame.com
wundversorgung-tirol.com
wholistic-choice.com
shingletownrrn.com
kapikenya.com
Targets
-
-
Target
25e4adba5d0ef98cb4f2a30b964254c5189d687d8af747533fe380907f36173b
-
Size
525KB
-
MD5
2047db38e2d0017545a2842b5266b9ad
-
SHA1
298b391c34e934bda7808a54e601b6c64dfba05c
-
SHA256
25e4adba5d0ef98cb4f2a30b964254c5189d687d8af747533fe380907f36173b
-
SHA512
42301389bb71daf31c8ac50640eee94a6e7ecef85e07e7ff3f78d3a6e69eb68207ffadb50cc417bf724ce124c6c21e7eb16f1baaf9fb05c1fbabae07d1481fd7
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-