General
-
Target
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
Size
925KB
-
Sample
220428-d28tpsbae7
-
MD5
4470f83cba058890c43ded4a3940c3dc
-
SHA1
f9c2953280646715ec9ad0d034a6eae43d1fc8c4
-
SHA256
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
SHA512
8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981
Malware Config
Extracted
xloader
2.5
arh2
anniversaryalert.com
kinship.space
buabdullagroup.com
ghostprotectionagency.com
scion-go-getter.com
skindeepapp.com
kysp3.xyz
bonitaspringshomesearch.com
bestdeals2022.online
themarketingstinger.com
chengkayouxuan.com
fendoremi.com
j-stra.com
klingelecn.net
deluxecarepro.com
huanbaodg.com
mes-dents-blanches.com
solutionsemissionsimplifiee.com
abedbashir.tech
good-collection.store
Targets
-
-
Target
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
Size
925KB
-
MD5
4470f83cba058890c43ded4a3940c3dc
-
SHA1
f9c2953280646715ec9ad0d034a6eae43d1fc8c4
-
SHA256
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
SHA512
8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload
-
Suspicious use of SetThreadContext
-