General

  • Target

    495a3851285b29a43693cf5a93516608

  • Size

    1.2MB

  • Sample

    231226-bv46tscfa7

  • MD5

    495a3851285b29a43693cf5a93516608

  • SHA1

    7ef194179534a1d0a1a7aa4aacd504c0f6e05853

  • SHA256

    d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be

  • SHA512

    2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3

  • SSDEEP

    24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Targets

    • Target

      495a3851285b29a43693cf5a93516608

    • Size

      1.2MB

    • MD5

      495a3851285b29a43693cf5a93516608

    • SHA1

      7ef194179534a1d0a1a7aa4aacd504c0f6e05853

    • SHA256

      d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be

    • SHA512

      2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3

    • SSDEEP

      24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Xloader payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks