General
-
Target
A2EE9578DDEE549F73290D0AB43B24C7C3E5273C06CA2B2BA03B5094FF0D3F58
-
Size
482KB
-
Sample
221123-r1xa6sda4x
-
MD5
10b0153a14584e3c95fc44f55be3d141
-
SHA1
3944790ae49859dd2ea00f1599fb11579f5440c4
-
SHA256
a2ee9578ddee549f73290d0ab43b24c7c3e5273c06ca2b2ba03b5094ff0d3f58
-
SHA512
614676bae1523c62d3995f049174f1603ce94e6bd36a8bfe2ebc37a575e91df9d01a373ed966430e5fd0a15495dc08dceb3c8466f96c9e7a326355b6849d28a6
-
SSDEEP
12288:/LTPgqBNd4Zmpont1kGZsVhKGKbYak3fsWkGXqG9:/LTzNt+nt9ZsJYk3Jk1A
Malware Config
Extracted
xloader
2.5
euv4
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
Targets
-
-
Target
Se adjunta factura vencida.exe
-
Size
909KB
-
MD5
b503a5194196b2870842bd02c7721aa6
-
SHA1
82e341f5744e92c7c0a65074a5160c03610338e3
-
SHA256
bec4ef3573fb041d4a688c353f4682186f2bfe3918e9add4b9c5ceda5ec2627c
-
SHA512
359a38f394d36cf84c8a3aaab738d1e0118127d4a9cbac853a96ed21346eb9d52e983bd452b56c79728a52f367117d54a5b16c3e976d56a0bab9ed65d3b6defb
-
SSDEEP
12288:YGCVtDP87+Aq/cWHC++mvCY7VloL2VmznaBDm21Rr3Srq0kRR:YGSBbcWHUmvCiqiDdMBe
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
ModiLoader Second Stage
-
Xloader payload
-
Adds Run key to start application
-