General
-
Target
c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
-
Size
427KB
-
Sample
230129-yg5lrsbc93
-
MD5
881cb9ada2d3716cd4330896b3e4987c
-
SHA1
b678a01eef1a01228e2f7a6ca6896d23a7c7e21e
-
SHA256
c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
-
SHA512
99d32f86d2b242dc8045bba1161e070d1312d04b4d631b703b3bd0d7a2d1a4854cd464456a3746952420d75a146720cec97827ec8471ac2ad3b6fbb9e047ece4
-
SSDEEP
12288:73WVhLHvDXG4KFi1bdhWJ562uF14cedCLUdLLLj:7GVxrX0gpdUXu8vQeX
Malware Config
Extracted
xloader
2.3
ur06
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
-
Size
427KB
-
MD5
881cb9ada2d3716cd4330896b3e4987c
-
SHA1
b678a01eef1a01228e2f7a6ca6896d23a7c7e21e
-
SHA256
c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
-
SHA512
99d32f86d2b242dc8045bba1161e070d1312d04b4d631b703b3bd0d7a2d1a4854cd464456a3746952420d75a146720cec97827ec8471ac2ad3b6fbb9e047ece4
-
SSDEEP
12288:73WVhLHvDXG4KFi1bdhWJ562uF14cedCLUdLLLj:7GVxrX0gpdUXu8vQeX
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-