General
-
Target
7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
-
Size
966KB
-
Sample
230129-y4t4jsbh79
-
MD5
c0333ad2c54dbeaa683f72272f7cdb9e
-
SHA1
6b83bdd574eec43323edbe989f631bbe995f4e03
-
SHA256
7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
-
SHA512
02b6cca699f30c0f049f572150a5ebc1361ed020cd0aa9884d2e87ac90a2d362a5aed04e1a687d30a43fbf34754b14f56e999f39b60da7155f62f828e4004fe0
-
SSDEEP
12288:ApRCK127BZddxiQZxXapnl/DAr52S1rKgU19Mx+TYW/l0RLq2W3/T:ADCNR8DXScgU19MxbW/GEPT
Malware Config
Extracted
xloader
2.3
ur06
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
-
Size
966KB
-
MD5
c0333ad2c54dbeaa683f72272f7cdb9e
-
SHA1
6b83bdd574eec43323edbe989f631bbe995f4e03
-
SHA256
7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
-
SHA512
02b6cca699f30c0f049f572150a5ebc1361ed020cd0aa9884d2e87ac90a2d362a5aed04e1a687d30a43fbf34754b14f56e999f39b60da7155f62f828e4004fe0
-
SSDEEP
12288:ApRCK127BZddxiQZxXapnl/DAr52S1rKgU19Mx+TYW/l0RLq2W3/T:ADCNR8DXScgU19MxbW/GEPT
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-