General
-
Target
b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513
-
Size
508KB
-
Sample
211209-cy2qjsagb2
-
MD5
ca0d7b52d537773db4598a25fdf5cf22
-
SHA1
f971b4ac64190312edfd3830dd40a257316c7e8f
-
SHA256
b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513
-
SHA512
58b69ca75d881acf8d90e3c22859dff514f796872460e619bd4699f71abbeb02ccc6832b583d29e916b6f993d508018b50d59cd8d46859251cb12e9e14d91195
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
Targets
-
-
Target
b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513
-
Size
508KB
-
MD5
ca0d7b52d537773db4598a25fdf5cf22
-
SHA1
f971b4ac64190312edfd3830dd40a257316c7e8f
-
SHA256
b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513
-
SHA512
58b69ca75d881acf8d90e3c22859dff514f796872460e619bd4699f71abbeb02ccc6832b583d29e916b6f993d508018b50d59cd8d46859251cb12e9e14d91195
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-