General
-
Target
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
-
Size
324KB
-
Sample
220121-m89h9acfcj
-
MD5
b1e0b1657595b806097a1529c2ae0620
-
SHA1
7cdd036a4769354e8a325c2231456187ee211cef
-
SHA256
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
-
SHA512
f7c05ecd44b986eafc3e0ea9a9f1bdb785fee6e3538b25f79d567aebf666758be0a2583123d061a74cf8325d39a3422dd2390d405d5f215a6ebb5852e3a15243
Malware Config
Extracted
xloader
2.5
u6vb
blendedmatter.com
piquinmarketing.com
dubkirelax.online
optimumotoaksesuar.com
bendisle.com
islamicgeometricpatterns.net
cheesebox.online
lh-coaching.com
buildingmaterial.info
backwoods72.com
goodtreetee.com
zknqqpvsypx.mobi
phukienstreaming.com
turkistick.com
cbd-shop-portugal.com
imherllc.com
krallechols.quest
ttmmb.com
pornmodelsworld.com
weakyummy.space
Targets
-
-
Target
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
-
Size
324KB
-
MD5
b1e0b1657595b806097a1529c2ae0620
-
SHA1
7cdd036a4769354e8a325c2231456187ee211cef
-
SHA256
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
-
SHA512
f7c05ecd44b986eafc3e0ea9a9f1bdb785fee6e3538b25f79d567aebf666758be0a2583123d061a74cf8325d39a3422dd2390d405d5f215a6ebb5852e3a15243
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Sets service image path in registry
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-