General
-
Target
a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
-
Size
728KB
-
Sample
220521-rswpnshfe7
-
MD5
7bf97c78987dee44d858343ed72da24b
-
SHA1
e2a445bc4e5923b355aa977cfc73a94e08706c36
-
SHA256
a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
-
SHA512
d86e85ea50a4e8fc766c48b509d7bcabf43167ce58f731b6273c5b8c385f15b03e4c914bde8c569f508ecd6e9a7ccf5ee21d8558ef60097d7d8581c0318ee27f
Malware Config
Extracted
xloader
2.5
r007
trashpandaservice.com
mobileads.network
ascolstore.com
gelsinextra.com
bonestell.net
heitoll.xyz
ceapgis.com
mon-lapin.biz
miq-eva.com
rematedesillas.com
playingonline.xyz
hausense.quest
tnyzw.com
appsdial.com
addcolor.city
hagenoblog.com
michaelwesleyj.com
she-zain.com
lorhsems.com
karmaserena.com
Targets
-
-
Target
a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
-
Size
728KB
-
MD5
7bf97c78987dee44d858343ed72da24b
-
SHA1
e2a445bc4e5923b355aa977cfc73a94e08706c36
-
SHA256
a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
-
SHA512
d86e85ea50a4e8fc766c48b509d7bcabf43167ce58f731b6273c5b8c385f15b03e4c914bde8c569f508ecd6e9a7ccf5ee21d8558ef60097d7d8581c0318ee27f
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload
-
Suspicious use of SetThreadContext
-