General
-
Target
735f2dd2051269d409780124ab42684b
-
Size
787KB
-
Sample
231219-wsq7eabcdm
-
MD5
735f2dd2051269d409780124ab42684b
-
SHA1
66443515bba44268a282314173f47d124715f806
-
SHA256
05c725f7ddf2734baa5fd91bf542ca03731d754d41283a2c0fd78bc9c369f28a
-
SHA512
f56f766f5030cad37de65d80e38eb26290f656152b81c97fe41470c8356f202e35199606d19858c1aeb09af014f1c29914e02f7f42a84e70f54d8911575fc725
-
SSDEEP
12288:p3YPk+SBNMCt8uKOtmpz46bkIrz4im9SGrGJuuchOMB+iBxt9VjW:1YPwBL6bprcWGqJuHFx3VjW
Malware Config
Extracted
xloader
2.5
cuig
sofiathinks-elderly.net
lahamicoast.info
2shengman.com
cbsautoplex.com
arcana-candles.com
genrage.com
kukumiou.xyz
thequizerking.com
sonataproductions.com
rebuildgomnmf.xyz
ubcoin.store
yiyouxue.net
firstlifehome.com
mdx-inc.net
gotbn-c01.com
dinobrindes.store
jcm-iso.com
cliente-mais.com
mloujewelry.com
correoversoi.quest
Targets
-
-
Target
735f2dd2051269d409780124ab42684b
-
Size
787KB
-
MD5
735f2dd2051269d409780124ab42684b
-
SHA1
66443515bba44268a282314173f47d124715f806
-
SHA256
05c725f7ddf2734baa5fd91bf542ca03731d754d41283a2c0fd78bc9c369f28a
-
SHA512
f56f766f5030cad37de65d80e38eb26290f656152b81c97fe41470c8356f202e35199606d19858c1aeb09af014f1c29914e02f7f42a84e70f54d8911575fc725
-
SSDEEP
12288:p3YPk+SBNMCt8uKOtmpz46bkIrz4im9SGrGJuuchOMB+iBxt9VjW:1YPwBL6bprcWGqJuHFx3VjW
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-