General
-
Target
b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
-
Size
475KB
-
Sample
230129-yhag1sbc99
-
MD5
b3a02a5fe7271490ffb71864b290eb31
-
SHA1
42cca26695441ca89557dcc7ea09c4435b43c0b4
-
SHA256
b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
-
SHA512
70f47a995acd0cefc8ca4f116b2f6b03a00c897e7e50c59b5f842f23b003619926b135d9a44197f0a4f312fd7bf0ef0cb89596926385a8b76525561eb88d2bfa
-
SSDEEP
12288:/cz6hGcejvydcHYo+6pFxyYAARXWA8uWGXhlqFCA8KI:ECjo+6/xyYAARgwhY8n
Malware Config
Extracted
xloader
2.3
ur06
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
Targets
-
-
Target
b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
-
Size
475KB
-
MD5
b3a02a5fe7271490ffb71864b290eb31
-
SHA1
42cca26695441ca89557dcc7ea09c4435b43c0b4
-
SHA256
b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
-
SHA512
70f47a995acd0cefc8ca4f116b2f6b03a00c897e7e50c59b5f842f23b003619926b135d9a44197f0a4f312fd7bf0ef0cb89596926385a8b76525561eb88d2bfa
-
SSDEEP
12288:/cz6hGcejvydcHYo+6pFxyYAARXWA8uWGXhlqFCA8KI:ECjo+6/xyYAARgwhY8n
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-