General
-
Target
358617c3f29ddf056376c61812aaa5cf84b5b12eefbc652357b9a4f5e975d79c
-
Size
522KB
-
Sample
230129-yjfqesbd54
-
MD5
b18e598f9eba3ea6050fb0e70cc81cd4
-
SHA1
683f6f2ce4279c428870f29dae17bdce0d68a4b7
-
SHA256
358617c3f29ddf056376c61812aaa5cf84b5b12eefbc652357b9a4f5e975d79c
-
SHA512
c2ce9e88a445a8046bb3594324423b2e3ee84cf369a8a114c7053d8a6c588fb5ca3c9927656a973ba7530219f6293cda42dd073370073308a6f91dd006de7e08
-
SSDEEP
12288:Twm/lE0DO2lolaNVSI+Kn4DUYB6U3vrA:UmdfDO2JNVYKnnlUTA
Malware Config
Extracted
xloader
2.3
8zdn
yourherogarden.net
onlineharambee.net
cerrajeriaurgencias24horas.com
distritoforex.com
verifyclientserverssr.com
dandwg.com
co2-zero.global
joshssl.com
meckwt.com
theammf.com
rawclectic.com
gzgnetwork.com
richmondavenuecoc.com
nicolelyte.com
thetinyclosetboutique.com
llt-group.net
seven-sky-design.com
joganifinancialgrp.com
elementsvapes.com
bingent.info
Targets
-
-
Target
358617c3f29ddf056376c61812aaa5cf84b5b12eefbc652357b9a4f5e975d79c
-
Size
522KB
-
MD5
b18e598f9eba3ea6050fb0e70cc81cd4
-
SHA1
683f6f2ce4279c428870f29dae17bdce0d68a4b7
-
SHA256
358617c3f29ddf056376c61812aaa5cf84b5b12eefbc652357b9a4f5e975d79c
-
SHA512
c2ce9e88a445a8046bb3594324423b2e3ee84cf369a8a114c7053d8a6c588fb5ca3c9927656a973ba7530219f6293cda42dd073370073308a6f91dd006de7e08
-
SSDEEP
12288:Twm/lE0DO2lolaNVSI+Kn4DUYB6U3vrA:UmdfDO2JNVYKnnlUTA
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Xloader payload
-
Suspicious use of SetThreadContext
-