General
-
Target
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
-
Size
456KB
-
Sample
211217-tgwawaefbl
-
MD5
840e01d333583e11b123c378fc7741e4
-
SHA1
8b9e42afa53aedfbe89964ce50ab2dd15f7cb725
-
SHA256
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
-
SHA512
b39014a8ea82150672fe19a9d8082f85c156b925beba308207ae08d8bdd5d8ff1bdb52a04e93aa044ddf1bad7e70607c0095ced6b624c01d32ba6db67479166f
Malware Config
Extracted
xloader
2.5
fqiq
driventow.com
ipatchwork.today
bolder.equipment
seal-brother.com
mountlaketerraceapartments.com
weeden.xyz
sanlifalan.com
athafood.com
isshinn1.com
creationslazzaroni.com
eclecticrenaissancewoman.com
satellitephonstore.com
cotchildcare.com
yamacorp.digital
ff4cuno43.xyz
quicksticks.community
govindfinance.com
farmersfirstseed.com
megacinema.club
tablescaperendezvous4two.com
Targets
-
-
Target
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
-
Size
456KB
-
MD5
840e01d333583e11b123c378fc7741e4
-
SHA1
8b9e42afa53aedfbe89964ce50ab2dd15f7cb725
-
SHA256
a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
-
SHA512
b39014a8ea82150672fe19a9d8082f85c156b925beba308207ae08d8bdd5d8ff1bdb52a04e93aa044ddf1bad7e70607c0095ced6b624c01d32ba6db67479166f
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-