General
-
Target
a9dd9bda70b16a68d8f55e09a1f9bc5d29b49ca060d5642ac9057ab50968f262
-
Size
296KB
-
Sample
220118-ppkrwsbccl
-
MD5
5a7fb563dee97fc9d1ad8b00ce00a2f5
-
SHA1
98501bf8fbd4234fd696b41924899e8ba8f3655d
-
SHA256
a9dd9bda70b16a68d8f55e09a1f9bc5d29b49ca060d5642ac9057ab50968f262
-
SHA512
d4a17caebe6570c186a383c92c678567165f6d5965cde2313a2debe2f55cea9b53e6d8436f49cdb718bd2dfb3122f6f23c28c2543d2c23c4cb547f1c84a95495
Malware Config
Extracted
xloader
2.5
o6tg
turkscaicosonline.com
novelfoodtech.com
zgrmfww.com
gestionalcliente24hrs.store
postrojka.com
tapissier-uzes.com
tobytram.one
preamblegames.com
clicklinkzs.com
franksenen.com
beautygateway.net
foils-online.com
aout.us
promarkoperations.com
alignatura.com
changemylifefast.info
minbex.icu
internethustlersociety.com
chinacqn.com
fibsh.com
Targets
-
-
Target
a9dd9bda70b16a68d8f55e09a1f9bc5d29b49ca060d5642ac9057ab50968f262
-
Size
296KB
-
MD5
5a7fb563dee97fc9d1ad8b00ce00a2f5
-
SHA1
98501bf8fbd4234fd696b41924899e8ba8f3655d
-
SHA256
a9dd9bda70b16a68d8f55e09a1f9bc5d29b49ca060d5642ac9057ab50968f262
-
SHA512
d4a17caebe6570c186a383c92c678567165f6d5965cde2313a2debe2f55cea9b53e6d8436f49cdb718bd2dfb3122f6f23c28c2543d2c23c4cb547f1c84a95495
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-