General
-
Target
a38729e20e3923799d71f59f1f06626a
-
Size
665KB
-
Sample
231222-qqjrnahben
-
MD5
a38729e20e3923799d71f59f1f06626a
-
SHA1
4584ce72f20718091af38760eba105e1b01b1f8d
-
SHA256
caee115a3bb2028fd81681b1fef997f87893c603dd42ca0932896029424ed1e7
-
SHA512
0b31792ee2580053f111ffb066fb7a9c88c9c03e412bef1390bb302d1d4174f45e45e2e921679c19fe77d60f49948e99d695cb2cca393f6deebbf041de19fa2f
-
SSDEEP
6144:77FJLgGB3g0ZDuuAXi+U6jPfhAv7n8IpWoHIHmmoYaQVp8PNUPq5HpD:bw0pjAS+U66vNW+I3/aop3
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
Targets
-
-
Target
a38729e20e3923799d71f59f1f06626a
-
Size
665KB
-
MD5
a38729e20e3923799d71f59f1f06626a
-
SHA1
4584ce72f20718091af38760eba105e1b01b1f8d
-
SHA256
caee115a3bb2028fd81681b1fef997f87893c603dd42ca0932896029424ed1e7
-
SHA512
0b31792ee2580053f111ffb066fb7a9c88c9c03e412bef1390bb302d1d4174f45e45e2e921679c19fe77d60f49948e99d695cb2cca393f6deebbf041de19fa2f
-
SSDEEP
6144:77FJLgGB3g0ZDuuAXi+U6jPfhAv7n8IpWoHIHmmoYaQVp8PNUPq5HpD:bw0pjAS+U66vNW+I3/aop3
Score10/10-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload
-
Suspicious use of SetThreadContext
-