General
-
Target
6080340073021440.zip
-
Size
327KB
-
Sample
220130-pznxasbbgk
-
MD5
bc057881eb65abf9ce79c8bf6c30c9b2
-
SHA1
09c9ae2dfcc896f801687cde4c5a9a88c277c82a
-
SHA256
7da29336c4fdb0a6228f89d3518d2c7919124b27e421bf6a532a7455c3dce642
-
SHA512
041220da0be2fed1af40ace438280fb2065a187eed5dc0bb77acc461ee2d50330e77603a96b0914035d7d9080915ead4d0b79cbcf8aadc2e4b0eced32e77c982
Malware Config
Extracted
xloader
2.5
quc5
writerpilotpublishing.com
journeywands.com
madacambo.com
boreslirealestate.com
drillshear.com
urbanmastic.com
focalbunk.com
ghpgroupinc.xyz
rfgmhnvf.com
241mk.com
mandolinzen.com
thenorthstarbets.com
oggperformancehorses.com
webuywholesalerhouses.com
cinreyyy.com
theyoungwedding.com
neuro-ai-web-ru.digital
zavienniky.xyz
kin-school.com
lowratepersonalloans.com
Targets
-
-
Target
b95b2708e33befda87ea5e9970f51f8fb92741b4ccf59ba6e0e81bca5a10aa1b
-
Size
470KB
-
MD5
b3dfff5713cd5c14b318b5e8d03f165f
-
SHA1
1086c8695b1475bdefced78b602fab5c684e03e6
-
SHA256
b95b2708e33befda87ea5e9970f51f8fb92741b4ccf59ba6e0e81bca5a10aa1b
-
SHA512
690768d0fe8ec516530df185dd263097ad3657673c21bd3d7547f90b9061443bd650ff88336b162612390705b9364666e4192c081a465d138ad2239489889cbb
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-