General
-
Target
d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2
-
Size
984KB
-
Sample
230129-y8hw3sde71
-
MD5
1451fb0f3e10bfec2ff424da9147c75e
-
SHA1
1f8e0881fad737fc59d900c53d46ccc937ccdf3a
-
SHA256
d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2
-
SHA512
51786f8ef1b6877b872ae2c7e564b52ea731cefef3e037b1b56cc4a363dbf602bfa455d17c09b6c1d9e15e11e11a7e149e885b87ef9c203cbd4aac603e32bf8d
-
SSDEEP
12288:OWW3hkl/81RWR+5eJ0rGqvcRSvYRPyZVSBWeFkTxv39:ikl0DxeJyGh4YRPLFkJ9
Malware Config
Extracted
xloader
2.3
e68n
ds3i.com
integrityconnect.info
jhpaolilo.com
aprilgraberphotography.com
globe-gist.com
blackwellheatingandcooling.com
gossgoddard.com
memoriesmade-l.com
ozsmiwd.icu
pelzerforcongress.com
infinitybytg.com
gczp22.com
logonanet.com
998899sj.com
xn--vhqqb859burbuz7jebh.com
savorysinsation.com
cumykuf.icu
ourbella.com
isurfkarma.com
thepostmail.com
Targets
-
-
Target
d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2
-
Size
984KB
-
MD5
1451fb0f3e10bfec2ff424da9147c75e
-
SHA1
1f8e0881fad737fc59d900c53d46ccc937ccdf3a
-
SHA256
d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2
-
SHA512
51786f8ef1b6877b872ae2c7e564b52ea731cefef3e037b1b56cc4a363dbf602bfa455d17c09b6c1d9e15e11e11a7e149e885b87ef9c203cbd4aac603e32bf8d
-
SSDEEP
12288:OWW3hkl/81RWR+5eJ0rGqvcRSvYRPyZVSBWeFkTxv39:ikl0DxeJyGh4YRPLFkJ9
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-