General
-
Target
SecuriteInfo.com.Trojan.Generic.30079212.6969.5055.exe
-
Size
708KB
-
Sample
230329-ajw6eaff9w
-
MD5
56be73f263468918f8a5046c2c04fa5f
-
SHA1
1ab1706d7a19bb746be2c3130e3e8ccc8a581d7f
-
SHA256
2693c8389ae1a86a3cdd7d300c501c0220768773cc4fb9397e54eb0f48dd1aa1
-
SHA512
49cba16a3f0acafb79a3e6634564283704ceaf2b9699c11050757b67a18eb6fc9a75244189c9ee3116b168314aff6809a5ec908a9dcff627c899de9302f54def
-
SSDEEP
6144:sW84SOPXfW5yDTjh3ffkmExvCr78JyUPsj/rhGAatgpX5eOfY5X:shQvWrxvCr7sywsj/rhGI
Malware Config
Extracted
xloader
2.3
mej0
mtxs8.com
quickskiplondon.com
sltplanner.com
generatedate.com
amsinspections.com
tomrings.com
109friends.com
freelovereading.com
avalapartners.com
nordiqueluxury.com
inmbex.com
everybankatm.com
bo1899.com
ashymeadow.com
pubgm-chickendinner.com
takudolunch.com
carlagremiao.com
actonetheatre.com
wemhealth.com
khasomat.net
Targets
-
-
Target
SecuriteInfo.com.Trojan.Generic.30079212.6969.5055.exe
-
Size
708KB
-
MD5
56be73f263468918f8a5046c2c04fa5f
-
SHA1
1ab1706d7a19bb746be2c3130e3e8ccc8a581d7f
-
SHA256
2693c8389ae1a86a3cdd7d300c501c0220768773cc4fb9397e54eb0f48dd1aa1
-
SHA512
49cba16a3f0acafb79a3e6634564283704ceaf2b9699c11050757b67a18eb6fc9a75244189c9ee3116b168314aff6809a5ec908a9dcff627c899de9302f54def
-
SSDEEP
6144:sW84SOPXfW5yDTjh3ffkmExvCr78JyUPsj/rhGAatgpX5eOfY5X:shQvWrxvCr7sywsj/rhGI
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-